EQTY LabDocs

Key Management

Configure key management for deployment

View as Markdown

Key management services are used to securely store and manage cryptographic signing keys for Decentralized Identifiers (DIDs) in the Guardian Platform. When the platform creates DIDs for users and organizations, cryptographic keys are generated and stored in a managed key vault for secure signing operations.

Supported Key Management Providers

The Guardian Platform supports the following cloud key management services:

  • Azure Key Vault – Microsoft Azure’s managed key vault service
  • AWS KMS (AWS Key Management Service) – Amazon’s managed encryption and key management service

Auth Service also supports Google Cloud KMS and OpenBao Transit, which this deployment guide does not cover. See Key Configuration.

Choosing a Provider

Select a key management provider based on your organization’s cloud infrastructure:

  • Azure Key Vault: Best for organizations using Azure cloud services or Microsoft Entra ID for authentication
  • AWS KMS: Ideal for organizations with AWS infrastructure or using AWS S3 for storage

AWS KMS keeps keys in FIPS 140-3 validated hardware security modules (HSMs). Auth Service creates Azure Key Vault keys as software-protected EC keys, which are not HSM-backed on any vault tier.

Both providers offer:

  • Centralized key lifecycle management
  • Audit logging and compliance features