Azure Managed HSM vs OpenStack Barbican

Azure Managed HSM is a cloud service for managing cryptographic keys backed by hardware security modules. It supports customer-managed keys, automatic key rotation, audit logs and key import through a web-accessed service. Both listed key types are supported. The Standard B1 plan is a Managed HSM pool billed by hourly usage fee per HSM pool; no price is provided. Azure lists no free plan. The cloud deployment model suits organisations that want managed HSM capabilities rather than a self-hosted installation. Key import allows existing keys to be brought into the service, while automatic rotation handles scheduled key changes. Audit logs provide activity records for review. Teams evaluating the service can focus on whether HSM-backed protection, customer control, import, rotation and logging meet their key-management needs, and whether hourly pool billing fits their usage.

OpenStack Barbican is the OpenStack Key Manager service for storing, provisioning, and managing secrets such as keys, certificates, passwords, and raw binary data. Its barbican-api component provides an OpenStack-native REST API for managing secrets; barbican-worker and barbican-keystone-listener are also part of the service. The listener manages Barbican’s database records for Keystone projects when those projects are deleted. A plugin architecture lets operators connect software secret stores or hardware such as HSMs. Documented options include KMIP, Dogtag, and Vault secret-store plugins, as well as PKCS#11 crypto plugins. With PKCS#11, master encryption and HMAC keys can reside in an HSM. Operators can develop plugins for storage, generation, and event handling, though support status may be stable, experimental, or out-of-tree. The default Simple Crypto plugin stores its single encryption key in plaintext in barbican.conf, so service-node access must be restricted carefully. Container ACL settings do not carry over to associated secrets, and ACL functionality requires Keystone integration. Barbican is free under Apache 2.0; installation guidance assumes a working OpenStack deployment.