Single service comparison

AWS KMS is a standalone regional key service scoped to customer master keys, grants, aliases, and envelope encryption, with access governed by IAM and resource-level key policies plus the grant model. Huawei folders equivalent capabilities under Data Encryption Workshop (DEW), which is an umbrella product exposing four microservices: KMS for keys, CSMS for secrets, KPS for SSH key pairs, and DHSM for single-tenant HSMs. There is no separate standalone KMS SKU name in the catalog; architects target the KMS microservice within DEW, so procurement and console navigation differ from AWS's dedicated KMS console.

API and data-model differences matter for cutover. AWS KMS uses the KMS API (CreateKey, Encrypt, Decrypt, GenerateDataKey, CreateGrant) with ARN-identified keys and cross-account key sharing. DEW KMS exposes REST APIs over HTTPS with project-scoped key identifiers and IAM-based authorization, and the documented throttle is 20 TPS per user with retry guidance for 502/504/429 errors; AWS KMS quotas are per-call and per-region and typically higher. DEW key quotas are governed by a service quota, and Basic Edition KMS limits custom keys to two, which can constrain multi-key designs common on AWS.

Integration, scaling, and operational responsibility diverge. AWS KMS is tightly integrated with dozens of AWS services for server-side encryption and emits per-request CloudTrail events. DEW KMS integrates with OBS, EVS, IMS, and related Huawei services, with CMKs stored redundantly online and root keys backed up offline. For FIPS 140-2 Level 3 single-tenant control, AWS offers CloudHSM separately while Huawei offers DHSM within the same DEW product family. Migration of operational ownership audit, key-rotation policy, and cross-account consumption patterns must be rebuilt on Huawei IAM and Cloud Trace, not assumed as parity.

Assess first: inventory AWS KMS CMKs, aliases, key policies, grants, and service-linked keys; classify by region, rotation state, and dependent AWS services that consume them. Map each to a DEW KMS target in the matching Huawei region, and decide whether secrets currently in AWS Secrets Manager map to DEW CSMS and whether any CloudHSM workloads map to DHSM. Confirm regional availability of DEW and its KMS microservice, and check current key quotas versus your AWS key count before provisioning, since Basic Edition limits custom keys to two.

For key and configuration migration, AWS KMS keys cannot be exported in plaintext, so plan re-encryption rather than key import: create new DEW CMKs, establish envelope-encryption call sites in your application using the DEW KMS REST API, and rewrap existing ciphertext under new data keys. Rebuild IAM authorization: translate AWS key policies and grants into Huawei IAM policies and project/enterprise-project scoping, accept that cross-account key sharing works differently, and adjust code that relies on ARNs, grant tokens, or aliasARN references. Replace CloudTrail KMS-event expectations with Cloud Trace Service auditing.

Validate before cutover with functional and load tests: verify encrypt/decrypt, GenerateDataKey-equivalent envelope flows, rotation scheduling, and the DEW TPS behavior by load testing against the 20-TPS limit with the documented retry strategy (3 to 5 retries, 5 to 8 second backoff for 502/504). Confirm that dependent Huawei services such as OBS, EVS, and IMS correctly reference the new CMKs, and that KPS-managed SSH key pairs for ECS/BMS are reconciled with any AWS-issued pairs. Perform canary decryption validation across a sample of migrated ciphertext to catch missing key references.

Mind the gaps and cost model. Do not assume one-click parity: cross-account access, grant-based temporary delegation, custom key stores, and AWS Lambda environment encryption have varying or no direct Huawei equivalents and require redesign. DEW is billed via yearly/monthly packages or pay-as-you-go editions plus quota tiers, not purely per-key-storage and per-request like AWS KMS; recalculate TCO using your peak request rate, key count, DHSM needs, and cross-region traffic. Document residual risks such as lower default TPS and Basic Edition key limits, and plan a support-ticket uplift request if production throughput exceeds defaults.