Multi-Cloud Encryption Compare

Encryption Comparison Filters

[
  {
    "feature": "Default encryption at rest",
    "category": "At Rest",
    "aws": "SSE-S3 (AES-256) enabled by default on all new S3 buckets",
    "azure": "Azure Storage Service Encryption (SSE) with platform-managed keys by default",
    "gcp": "Google-managed encryption keys (AES-256) applied automatically to all data"
  },
  {
    "feature": "Customer-managed keys",
    "category": "At Rest",
    "aws": "AWS KMS Customer Managed Keys (CMK) with configurable key policies",
    "azure": "Azure Key Vault managed keys (CMK) with RBAC and access policies",
    "gcp": "Cloud KMS Customer-Managed Encryption Keys (CMEK) with IAM controls"
  },
  {
    "feature": "Customer-supplied keys",
    "category": "At Rest",
    "aws": "SSE-C: customer provides encryption key with each request; AWS does not store the key",
    "azure": "Customer-supplied keys on Blob storage requests; key provided per-operation",
    "gcp": "Customer-Supplied Encryption Keys (CSEK): provide AES-256 or RSA key per API call"
  },
  {
    "feature": "Database encryption",
    "category": "At Rest",
    "aws": "RDS encryption via KMS; Aurora encrypted storage; DynamoDB encryption at rest",
    "azure": "Transparent Data Encryption (TDE) for SQL Database and SQL MI; Cosmos DB encryption",
    "gcp": "Cloud SQL encryption at rest by default; Spanner and Firestore encryption with CMEK support"
  },
  {
    "feature": "Disk encryption",
    "category": "At Rest",
    "aws": "EBS encryption with KMS keys; default encryption enforceable per region",
    "azure": "Azure Disk Encryption (ADE) with BitLocker/DM-Crypt; SSE with PMK or CMK",
    "gcp": "Persistent Disk encryption by default; CMEK and CSEK supported"
  },
  {
    "feature": "Object storage encryption",
    "category": "At Rest",
    "aws": "S3 SSE-S3, SSE-KMS, and SSE-C; bucket-level default encryption configuration",
    "azure": "Blob Storage encryption with platform-managed, customer-managed, or customer-provided keys",
    "gcp": "Cloud Storage encryption with Google-managed, CMEK, or CSEK keys; per-object key support"
  },
  {
    "feature": "TLS enforcement",
    "category": "In Transit",
    "aws": "ACM for certificate provisioning; ALB/CloudFront TLS termination; S3 bucket policies to enforce HTTPS",
    "azure": "App Service managed certificates; Azure Front Door TLS; enforce HTTPS via policy",
    "gcp": "Google-managed SSL certificates; Cloud Load Balancing TLS; enforce HTTPS on App Engine and Cloud Run"
  },
  {
    "feature": "Service-to-service encryption",
    "category": "In Transit",
    "aws": "VPC traffic encrypted via TLS; PrivateLink for private service endpoints; mTLS with App Mesh",
    "azure": "VNet encryption in transit; Private Link endpoints; mTLS with Service Mesh / Istio on AKS",
    "gcp": "Automatic encryption between GCP services (ALTS); Private Service Connect; Istio mTLS on GKE"
  },
  {
    "feature": "Key rotation",
    "category": "Key Management",
    "aws": "Automatic annual rotation for KMS symmetric keys; on-demand rotation supported",
    "azure": "Configurable auto-rotation in Key Vault with custom rotation period; near-expiry alerts",
    "gcp": "Automatic rotation with configurable period in Cloud KMS; manual rotation also available"
  },
  {
    "feature": "HSM support",
    "category": "Key Management",
    "aws": "AWS CloudHSM (FIPS 140-2 Level 3); KMS custom key stores backed by CloudHSM",
    "azure": "Azure Managed HSM (FIPS 140-2 Level 3); Key Vault Premium tier with HSM-backed keys",
    "gcp": "Cloud HSM (FIPS 140-2 Level 3); Cloud KMS keys can be backed by Cloud HSM"
  },
  {
    "feature": "Key import (BYOK)",
    "category": "Key Management",
    "aws": "KMS import key material: wrap with KMS public key and import; supports RSA and AES wrapping",
    "azure": "Key Vault import keys via secure transfer; supports nCipher/Thales HSM tooling for BYOK",
    "gcp": "Cloud KMS import jobs: wrap key material with Google-provided wrapping key; RSA-OAEP supported"
  },
  {
    "feature": "BYOK support",
    "category": "Key Management",
    "aws": "Yes: import AES-256 or RSA key material into KMS; maintain key material control externally",
    "azure": "Yes: import keys into Key Vault or Managed HSM; key material origin tracked and auditable",
    "gcp": "Yes: import key material into Cloud KMS via import jobs; supports symmetric and asymmetric keys"
  },
  {
    "feature": "Envelope encryption",
    "category": "Key Management",
    "aws": "Data encrypted with data key (DEK); DEK encrypted with KMS master key (CMK); GenerateDataKey API",
    "azure": "Data encrypted with DEK; DEK wrapped with Key Vault key encryption key (KEK); SDK support",
    "gcp": "Data encrypted with DEK; DEK encrypted with Cloud KMS key (KEK); Tink library integration"
  },
  {
    "feature": "FIPS 140-2 validation",
    "category": "Compliance",
    "aws": "KMS: FIPS 140-2 Level 2; CloudHSM: FIPS 140-2 Level 3; GovCloud FIPS endpoints",
    "azure": "Key Vault: FIPS 140-2 Level 2; Managed HSM: FIPS 140-2 Level 3; Azure Government support",
    "gcp": "Cloud KMS: FIPS 140-2 Level 2; Cloud HSM: FIPS 140-2 Level 3; BoringCrypto module validated"
  },
  {
    "feature": "Audit logging for key usage",
    "category": "Compliance",
    "aws": "CloudTrail logs all KMS API calls; S3 data events for object-level encryption tracking",
    "azure": "Azure Monitor / Diagnostic Logs for Key Vault operations; Activity Log for management events",
    "gcp": "Cloud Audit Logs for all Cloud KMS operations; Data Access logs for key usage tracking"
  }
]