---
id: "key-management"
type: "kind"
category: "security"
url: "https://localhost:3000/catalogue/kinds/key-management"
---

# Key management

Holds keys and secrets and rotates them.

| | |
|---|---|
| Category | Security |
| Properties | 5 |
| Components | 54 |
| Rules | 0 |

## Properties

| property | type | values | required | default |
|---|---|---|---|---|
| `envelopeEncryption` | boolean | — | no | false |
| `hsm` | boolean | — | no | false |
| `managed` | boolean | — | no | true |
| `rotationAutomated` | boolean | — | no | false |
| `rotationDays` | integer | — | no | — |

## Rules for this kind · 0

No rule selects this kind or its category.

## Components · 54

### vendor-neutral

- [Generic key management](https://localhost:3000/catalogue/components/key-management.md) `key-management` — the kind itself

### alibabacloud

- [Certificate Management Service](https://localhost:3000/catalogue/components/alibaba-certificate-management.md) `alibaba-certificate-management` — 1 defaults
- [Data Encryption Service](https://localhost:3000/catalogue/components/alibaba-data-encryption-service.md) `alibaba-data-encryption-service` — 2 defaults

### aws

- [AWS Certificate Manager](https://localhost:3000/catalogue/components/aws-acm.md) `aws-acm` — 5 defaults
- [AWS KMS](https://localhost:3000/catalogue/components/aws-kms.md) `aws-kms` — 4 defaults
- [AWS Payment Cryptography](https://localhost:3000/catalogue/components/aws-payment-cryptography.md) `aws-payment-cryptography` — 4 defaults
- [AWS Private Certificate Authority](https://localhost:3000/catalogue/components/aws-private-ca.md) `aws-private-ca` — 4 defaults
- [AWS Secrets Manager](https://localhost:3000/catalogue/components/aws-secrets-manager.md) `aws-secrets-manager` — 4 defaults
- [AWS Signer](https://localhost:3000/catalogue/components/aws-signer.md) `aws-signer` — 3 defaults
- [AWS Systems Manager Parameter Store](https://localhost:3000/catalogue/components/aws-ssm-parameter-store.md) `aws-ssm-parameter-store` — 2 defaults
- [AWS CloudHSM](https://localhost:3000/catalogue/components/cloudhsm.md) `cloudhsm` — 4 defaults

### azure

- [Artifact Signing](https://localhost:3000/catalogue/components/azure-artifact-signing.md) `azure-artifact-signing` — 3 defaults
- [Azure Cloud HSM](https://localhost:3000/catalogue/components/azure-cloud-hsm.md) `azure-cloud-hsm` — 2 defaults
- [Azure Dedicated HSM](https://localhost:3000/catalogue/components/azure-dedicated-hsm.md) `azure-dedicated-hsm` — 3 defaults
- [Azure Key Vault](https://localhost:3000/catalogue/components/azure-key-vault.md) `azure-key-vault` — 3 defaults
- [Azure Key Vault Managed HSM](https://localhost:3000/catalogue/components/azure-managed-hsm.md) `azure-managed-hsm` — 3 defaults

### cloudflare

- [Advanced Certificate Manager](https://localhost:3000/catalogue/components/cloudflare-advanced-certificate-manager.md) `cloudflare-advanced-certificate-manager` — 2 defaults
- [Cloudflare Geo Key Manager](https://localhost:3000/catalogue/components/cloudflare-geo-key-manager.md) `cloudflare-geo-key-manager` — 1 defaults
- [Cloudflare Keyless SSL](https://localhost:3000/catalogue/components/cloudflare-keyless-ssl.md) `cloudflare-keyless-ssl` — 1 defaults
- [Cloudflare mTLS client certificates](https://localhost:3000/catalogue/components/cloudflare-mtls.md) `cloudflare-mtls` — 1 defaults
- [Cloudflare Origin CA](https://localhost:3000/catalogue/components/cloudflare-origin-ca.md) `cloudflare-origin-ca` — 1 defaults
- [Cloudflare Secrets Store](https://localhost:3000/catalogue/components/cloudflare-secrets-store.md) `cloudflare-secrets-store` — 3 defaults
- [Cloudflare Universal SSL](https://localhost:3000/catalogue/components/cloudflare-ssl-tls.md) `cloudflare-ssl-tls` — 2 defaults

### default

- [Bitwarden](https://localhost:3000/catalogue/components/bitwarden.md) `bitwarden` — 3 defaults
- [cert-manager](https://localhost:3000/catalogue/components/cert-manager.md) `cert-manager` — 4 defaults
- [CyberArk Conjur](https://localhost:3000/catalogue/components/conjur.md) `conjur` — 3 defaults
- [Doppler](https://localhost:3000/catalogue/components/doppler.md) `doppler` — 2 defaults
- [EJBCA](https://localhost:3000/catalogue/components/ejbca.md) `ejbca` — 3 defaults
- [Entrust nShield HSM](https://localhost:3000/catalogue/components/entrust-nshield.md) `entrust-nshield` — 3 defaults
- [HashiCorp Vault](https://localhost:3000/catalogue/components/hashicorp-vault.md) `hashicorp-vault` — 3 defaults
- [HCP Vault Dedicated](https://localhost:3000/catalogue/components/hcp-vault.md) `hcp-vault` — 3 defaults
- [Infisical](https://localhost:3000/catalogue/components/infisical.md) `infisical` — 3 defaults
- [1Password Connect](https://localhost:3000/catalogue/components/onepassword-connect.md) `onepassword-connect` — 3 defaults
- [OpenBao](https://localhost:3000/catalogue/components/openbao.md) `openbao` — 3 defaults
- [Sealed Secrets](https://localhost:3000/catalogue/components/sealed-secrets.md) `sealed-secrets` — 4 defaults
- [Smallstep step-ca](https://localhost:3000/catalogue/components/step-ca.md) `step-ca` — 3 defaults
- [Thales Luna HSM](https://localhost:3000/catalogue/components/thales-luna-hsm.md) `thales-luna-hsm` — 3 defaults

### gcp

- [Certificate Authority Service](https://localhost:3000/catalogue/components/google-certificate-authority-service.md) `google-certificate-authority-service` — 3 defaults
- [Certificate Manager](https://localhost:3000/catalogue/components/google-certificate-manager.md) `google-certificate-manager` — 3 defaults
- [Cloud External Key Manager](https://localhost:3000/catalogue/components/google-cloud-ekm.md) `google-cloud-ekm` — 4 defaults
- [Cloud HSM](https://localhost:3000/catalogue/components/google-cloud-hsm.md) `google-cloud-hsm` — 4 defaults
- [Google Cloud KMS](https://localhost:3000/catalogue/components/google-cloud-kms.md) `google-cloud-kms` — 4 defaults
- [Parameter Manager](https://localhost:3000/catalogue/components/google-parameter-manager.md) `google-parameter-manager` — 3 defaults
- [Secret Manager](https://localhost:3000/catalogue/components/google-secret-manager.md) `google-secret-manager` — 4 defaults

### ibm

- [IBM Cloud Hyper Protect Crypto Services](https://localhost:3000/catalogue/components/ibm-hyper-protect-crypto-services.md) `ibm-hyper-protect-crypto-services` — 4 defaults
- [IBM Key Protect](https://localhost:3000/catalogue/components/ibm-key-protect.md) `ibm-key-protect` — 4 defaults
- [IBM Cloud Secrets Manager](https://localhost:3000/catalogue/components/ibm-secrets-manager.md) `ibm-secrets-manager` — 2 defaults

### k8s

- [Secret](https://localhost:3000/catalogue/components/k8s-secret.md) `k8s-secret` — 4 defaults

### oci

- [OCI Certificates](https://localhost:3000/catalogue/components/oci-certificates.md) `oci-certificates` — 4 defaults
- [OCI External Key Management](https://localhost:3000/catalogue/components/oci-external-key-management.md) `oci-external-key-management` — 4 defaults
- [OCI Secret Management Service](https://localhost:3000/catalogue/components/oci-secret-management.md) `oci-secret-management` — 4 defaults
- [OCI Vault](https://localhost:3000/catalogue/components/oci-vault.md) `oci-vault` — 4 defaults
- [OCI Virtual Private Vault](https://localhost:3000/catalogue/components/oci-virtual-private-vault.md) `oci-virtual-private-vault` — 4 defaults

### openstack

- [OpenStack Barbican](https://localhost:3000/catalogue/components/openstack-barbican.md) `openstack-barbican` — 1 defaults

## Source (`kind` YAML, verbatim)

```yaml
# yaml-language-server: $schema=../schema/kind.schema.json
# Abstract kind: Holds keys and secrets and rotates them (KMS, HSM, Vault, Secrets Manager).
schemaVersion: "1"
type: "kind"
id: "key-management"
category: "security"
properties:
  hsm:
    type: "boolean"
    default: false
  rotationAutomated:
    type: "boolean"
    default: false
  rotationDays:
    type: "integer"
  envelopeEncryption:
    type: "boolean"
    default: false
  managed:
    type: "boolean"
    default: true
```

Human page: https://localhost:3000/catalogue/kinds/key-management