Side by side
AWS Key Management Service vs OpenStack Barbican
Both stand on key management software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan APIWeb
AWS KMS combines centralized key controls with multiple cryptographic operations and AWS service integrations. Account for per-key charges, separately billed API requests, and default limits when planning usage.
Visit AWS Key Management Service Free plan APILinuxSelf-hosted
Barbican offers OpenStack-native secret management with configurable storage integrations, including HSM support. Operators should account for its default key-storage tradeoff and the limits on container ACLs.
Visit OpenStack BarbicanThe facts
| AWS Key Management Service | OpenStack Barbican | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | API, Web | API, Linux, Self-hosted |
| Lowest paid plan | AWS KMS: $1 a month | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | aws.amazon.com | docs.openstack.org |
| On key management software | #1 of 25 | #2 of 25 |
AWS Key Management Service: what it does well
- Supports symmetric, asymmetric, and HMAC operations.
- Integrates with several AWS services.
- CloudTrail can record key requests and related details.
- Uses HSMs validated to FIPS 140-3 Security Level 3.
What to know first
- API requests are charged separately from key costs.
- Custom key stores are unavailable in two AWS China Regions.
- Custom key stores do not support asymmetric KMS keys.
- Default key and request limits apply.
OpenStack Barbican: what it does well
- REST API for provisioning and managing secrets
- Plugins can use software stores or HSMs
- Documented KMIP, Dogtag, Vault, and PKCS#11 options
- Custom plugins can handle storage, generation, and events
What to know first
- Default encryption key is plaintext in barbican.conf
- Container ACL settings do not extend to associated secrets
- Installation assumes a working OpenStack deployment
Alternatives to AWS Key Management Service Alternatives to OpenStack Barbican The whole list