* The pricing for just storing keys is incredibly cheap.
* At least with Google KMS you can't delete the keys without a 24 hour waiting period (and you can alert on the deletion attempt), so that's a huge safeguard.
* You get key access auditing out of the box.
There’s also a feature you can enable that automatically rotates your key once a year. KMS is great!
Why do you like their auto-rotation? The keys that are rotated out are not never disabled, so I don't really understand the benefit. In what scenario would their auto-rotation improve security?
The costs of that obviously scale in a completely different way from the per-key storage costs (which are actually zero, I think).
At $0.06/key/month, that's practically free for most reasonable use cases. For example, if there's 10k secrets that's $7,200/year.
If you encrypt/decrypt your secrets 1 million times per day (~11.6 times/s), the access charges would be $1,095/year (1 million operations/day * 365 days/year * $0.03 / 10,000 operations).