Cloud Key Management

What it means

Provider key-management services can integrate hardware protection, access policy, audit logging, rotation, and service encryption. Customer-managed keys increase control but also increase operational responsibility.

Why it matters

Encryption is only as trustworthy as the identity, policy, key lifecycle, and recovery process surrounding the keys.

Practical focus

• Separate key administration from data administration
• Limit which identities and services can use keys
• Plan rotation, backup, disablement, and destruction
• Monitor key-policy and usage events

Common mistakes

• Creating customer-managed keys without an operating plan
• Giving application administrators unrestricted key control
• Deleting keys before understanding data dependencies

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

Authoritative sources

• NIST SP 800-57 Part 1 Rev. 5 — Recommendation for Key Management
• NIST SP 800-144 — Security and Privacy in Public Cloud Computing
• AWS Well-Architected Framework
• Microsoft Azure Well-Architected Framework
• NIST SP 800-210 — General Access Control Guidance for Cloud Systems