AWS Key Management Service vs SAP Data Custodian Key Management Service

AWS Key Management Service creates and controls cryptographic keys for data encryption and digital signatures. It centralizes key lifecycles and permissions, including separate control over administrators and key users. KMS supports symmetric encryption, asymmetric signing or encryption pairs, and HMAC generation and verification. The AWS Encryption SDK can use KMS as a key provider for local application encryption and decryption. Integrations include Amazon S3, EBS, RDS, DynamoDB, Lambda, and CloudTrail. With CloudTrail enabled, requests can record the user, time, API action, and key. AWS says hardware security modules validated to FIPS 140-3 Security Level 3 protect key material and operations, with plaintext keys kept only in volatile HSM memory. Multi-Region keys support cross-Region workflows; external key stores keep material in a customer-managed external manager. KMS scales with demand but has default key and request limits. The listed plan is $1 a month per KMS key, prorated hourly.

SAP Data Custodian Key Management Service is a cloud service accessed through the web for managing cryptographic keys. It supports three listed key types: AES, RSA, and ECC. Automated key rotation changes keys according to the service’s rotation capability, while key audit logs provide records of key-related activity. The service supports external key control and also lists a combined external-and-other control option, giving organizations more than one way to handle control of keys. Its deployment model is cloud, and its platform is web. SAP sells the service on a paid basis. Pricing is available on request, and no free plan is listed. Organizations can use the service as a web-based cloud option when AES, RSA, or ECC management, rotation, control choices, and audit logging are requirements.