Alibaba Cloud Key Management Service vs KeyRack

Alibaba Cloud Key Management Service is a web-accessible cloud service for managing encryption keys. It supports customer-managed keys, key import, automatic rotation, audit logs, HSM-backed keys and both listed key types. Default keys are provided at no charge for server-side encryption of Alibaba Cloud services, including free service keys and customer master keys. The free plan sits alongside two prepaid subscription instances. The Software Key Management Instance costs $500 a month and includes 1,000 QPS, 1,000 keys, 0 secrets and 0 data keys. The Hardware Key Management Instance costs $1,799 a month and includes 2,000 QPS, 1,000 keys, 0 secrets and 0 data keys. Paid plans start at 500.0 /mo. The service is designed for cloud deployments where teams need imported, customer-managed or HSM-backed key controls.

KeyRack is an open-source key management coordination layer that you deploy in your own infrastructure, rather than use as a hosted cloud KMS. It tracks key hierarchies, drives rotation and delegates cryptographic operations to configured backends. Its KEK-wrapping hierarchies support namespace-scoped rules and cascade operations. Authorization is checked on every operation through an external policy decision point such as Cedar or OPA; KeyRack does not bundle an identity provider, but can integrate with OIDC providers including Keycloak, Auth0, Okta, Azure AD and Google Identity Platform. Backend choices include PKCS#11, HashiCorp Vault Transit, a KMIP client and in-process software for development and testing. Audit events can be delivered through NATS, files or stdout, with BLAKE3 hash-chain linking and optional Ed25519 signing. Non-exportable keys in an HSM or Vault provider remain there; exportable keys may leave through authorized export operations. The open-source core costs nothing under AGPL-3.0-or-later. Commercial licensing is available by contacting KeyRack for pricing and evaluation access.