External key management is a security arrangement in which encryption keys-often the root keys that protect other keys or data-are kept outside a cloud provider’s direct custody. An organization may store them in hardware security modules (HSMs) it owns or uses a trusted third-party service. The cloud workload must request access to use a key, subject to the configured controls.
This can reduce a provider’s ability to access protected data on its own and help organizations meet governance or regulatory requirements. In real deployments, key release may be restricted by identity policies, approval workflows, or checks that verify a workload’s environment. However, external custody does not remove every dependency: cloud services, identity systems, support processes, and recovery arrangements may still affect access. Teams should protect key backups, test recovery, monitor key-use requests, and plan for outages or loss of access.