Amazon EC2 vs OpenStack Barbican

Amazon EC2 provides resizable, secure compute capacity as virtual servers in the cloud. It offers over 1,000 instance types across Intel, AMD, and Arm processors for workloads including web and enterprise applications, high-performance computing, machine learning, SAP, Windows, and macOS. EC2 Auto Scaling can add or remove instances under dynamic or predictive policies. Instances can use persistent block storage through Amazon EBS and shared file storage through Amazon EFS; the service also provides a Query API and AWS SDKs. AWS says its Nitro System moves virtualization functions to dedicated hardware and isolates customer workloads. EC2 appears in AWS’s compliance program scope, though customers remain responsible for applicable compliance requirements. AWS states a 99.99% availability SLA commitment for each Region. Billing is per instance-hour or per second depending on instance type and operating system; eligible per-second use has a 60-second minimum. New AWS customers can receive up to $200 in credits, and the free plan lasts six months after account creation. The T4g free trial has monthly hour limits and surplus CPU credits can incur charges.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.