Single service comparison

Azure Key Vault unifies keys, secrets, and certificates behind one vault resource and data-plane API, whereas Huawei splits these across Data Encryption Workshop (DEW) for KMS/KPS keys and Cloud Certificate & Manager (CCM) for SSL/private certificate lifecycle. DEW's KMS exposes CMK creation, rotation, and envelope encryption integrated with OBS, EVS, and IMS, while secrets as standalone arbitary secret objects are not a first-class DEW resource; applications must model secrets via KMS-protected parameters or another store. Architects must reconcile the API surface rather than assume a one-to-one object model.

Scaling, isolation, and integration boundaries differ. Key Vault offers Standard and Premium (HSM-backed) tiers and software- or HSM-protected keys per vault, with regional vault instances and Azure RBAC plus access policies. DEW provides Basic KMS, Professional (Dedicated HSM with PKCS #11/JCE/CNG) and KPS for ECS login key pairs, while CCM hosts public SSL and private PCA hierarchies and deploys certificates to ELB, CDN, and WAF. Certificate-to-load-balancer deployment automation lives in CCM, not DEW, so Azure's single-vault workflow becomes a two-service handoff on Huawei Cloud.

Operational responsibility shifts. On Azure, Key Vault handles key versioning, soft-delete, purge protection, managed identity access, and certificate auto-rotation inside one service. On Huawei Cloud, key lifecycle and HSM custody live in DEW with redundant CMK storage and offline root-key backups, whereas CA hierarchy, issuance, renewal, and one-click SSL rotation live in CCM, with KMS/HSM protecting CCM keys. Teams must therefore operate two dashboards, two IAM scopes, and two audit trails (CTS) instead of Azure's unified vault logging.

Start with a per-object inventory of the Azure vault: list keys (type, protection level, rotation policy), secrets (consumers and reference method), and certificates (CA, domain, deployment targets such as App Service or Application Gateway). Decide target mapping per object: HSM-protected keys and CMK-based envelope encryption move to DEW KMS or Dedicated HSM; ECS SSH key pairs move to DEW KPS; public SSL and private certificates move to CCM (SSL Management and Private CA). Confirm regional availability and quotas for DEW Basic/Professional and CCM PCA in the destination Huawei region before cutover planning.

Re-key rather than export where possible. Azure software-protected keys and secrets can be re-created in DEW KMS and applications re-pointed to the DEW data-plane APIs (or Huawei SDK/KMS provider) and the KPS-managed key pairs for ECS. HSM-protected (BYOK) keys generally cannot be extracted; plan new CMKs in DEW Dedicated HSM and re-encrypt dependent data, or use supported import for key material where available. For certificates, issue replacements through CCM (public CA SSL or enterprise PCA) and redeploy to ELB, CDN, or WAF using CCM one-click deployment; no automated cross-cloud certificate import path is documented.

Validate control and data-plane parity before cutover: verify each consumer's auth path (IAM for DEW, CCM permissions, CTS audit), key rotation and versioning semantics, and envelope-encryption calls against DEW KMS APIs. Test renewal/rotation for CCM-managed certificates and confirm notification and deployment behavior. Run dual-run with both Azure Key Vault and Huawei DEW/CCM active, then cut over consumers progressively, rotating Azure keys to disabled/purged state only after observability shows no remaining dependency.

Account for cost and governance model changes. Azure typically bills vault operations, key versions, and Premium HSM tiers; Huawei bills DEW by edition (Basic/Professional Dedicated HSM) and CCM by SSL certificate validity (one-off per year) or Private CA monthly per-CA fees, plus KMS API calls. Recalculate TCO including re-encryption traffic, renewal/rotation cadence, cross-region key usage, and HSM provisioning. Mind documented gaps: no single unified vault API, secret-as-object parity is not built-in (use KMS-wrapped application secrets), and there is no official Azure-to-Huawei Key Vault migration tool—treat the move as a re-architecture, not a lift-and-shift.