自带密钥 (BYOK) 和客户管理密钥 (CMK) 加密之间的区别？

Question

On the documentation page of Azure I regularly read the abbreviation BYOK encryption (eg here ) and CMK encryption (eg here ).

Can these two terms be used synonymously or is there a difference?

Answer 1

They are often used interchangeably. BYOK usually means the vendor holds the key, but you create it and upload it. CMK can mean that but also sometimes reflects the case where you hold your key in your own KMS instead, so it tends to encompass more patterns than BYOK does in practice. Neither of these have formal definitions that you can rely on though.

Answer 2

Both are the same. In the azure postgres link you can see that both CMK and BYOK are mentioned in the same paragraph.

As a customer, You bring your own encryption key and you are responsible for managing it.