Key Management in Cloud Services
Updated: 12/09/2025
This publication provides updated, comprehensive guidance on how organizations should design, evaluate, and operate Key Management Systems (KMS) in modern cloud environments.
Building on NISTIR 7956 and other foundational standards, this document explains how traditional key management practices must adapt. Modern practices must account for shared infrastructure, multi-tenancy, and cloud provider trust boundaries. It also highlights how you should drive encryption through clearly defined business needs, rather than assume it as a default.
This publication also explores the four major cloud KMS architecture patterns. These include Cloud-Native, External Key Origination, External KMS, and Multi-Cloud KMS. It also provides practical, cloud-specific guidance for establishing a strong cryptographic key lifecycle, from generation and activation through rotation, archival, recovery, and destruction.
Additionally, this publication explores key management operations, governance controls, and policy requirements. It concludes with forward-looking insights into post-quantum cryptography and the emerging need for crypto-agility.
Key Takeaways:
- How the four dominant cloud KMS architectural patterns compare
- How to build a complete cryptographic key lifecycle aligned with cloud environments
- The governance, policy, and risk considerations unique to cloud encryption
- API and integration models for secure, scalable key management
- How to prepare for post-quantum transitions and future cryptographic requirements
Topics:
Best For:
- CISOs and security leaders
- Cloud and security architects
- IT and security administrators
- Compliance, audit, and risk management teams
- DevOps and platform engineering teams
- Cloud service providers and solution engineers
