Alibaba Cloud Key Management Service vs OpenStack Barbican

Alibaba Cloud Key Management Service is a web-accessible cloud service for managing encryption keys. It supports customer-managed keys, key import, automatic rotation, audit logs, HSM-backed keys and both listed key types. Default keys are provided at no charge for server-side encryption of Alibaba Cloud services, including free service keys and customer master keys. The free plan sits alongside two prepaid subscription instances. The Software Key Management Instance costs $500 a month and includes 1,000 QPS, 1,000 keys, 0 secrets and 0 data keys. The Hardware Key Management Instance costs $1,799 a month and includes 2,000 QPS, 1,000 keys, 0 secrets and 0 data keys. Paid plans start at 500.0 /mo. The service is designed for cloud deployments where teams need imported, customer-managed or HSM-backed key controls.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.