AWS adds bring your own key crypto to its cloudy S3 storage

You're right, I had gotten things mixed round in my brain. I was thinking of the Alliance Key Manager for Azure that everyone had been touting as the ultimate solution to Azure security problems (hah!) before Thales came around. What garbage.

Microsoft did have pre-thales stuff too. The previous generation's broken, expensive and Microsoft-vulnerable Windows RMS-based setup, for example. That's pre-Azure RMS that didn't use the hardware modules.

Oh, and the Cloudlink "we'll encrypt your VMs" offering that uses Bitlocker, which everyone is well aware was designed weak from the start and pwned by the NSA bloody ages ago. That was a laugh riot.

With Thales HSMs enterprises with Azure subscriptions and which have Thales hardware on their premises can secure (quoted from https://technet.microsoft.com/en-ca/library/dn440580.aspx)

application that integrates with Azure RMS. This includes cloud services such as SharePoint Online, on-premises servers that run Exchange and SharePoint that work with Azure RMS by using the RMS connector, and client applications such as Office 2013

You cannot secure Exchange online, general VMs, general storage or, well...most of the stuff on Azure with Thales HSM. The things you can secure with Thales HSM you are trusting Microsoft that the key can't be extracted, intercepted or used because, well, it's pretty much Microsoft's own applications that use it at this point. (Though, to be fair, non-Microsoft applications that integrate with Azure RMS could in theory benefit.)

So you're still back to trusting Microsoft (and Thales, who are slightly more trustworthy), though you can't use Thales for a lot of things. It's a start. And maybe once it can be used for every element of the public cloud computing experience and we can guarantee every nanosecond of the chain of custody for the keys from you to the hardware device on Microsoft's premises can't be spied upon Azure will be ready for mildly sensitive workloads.

Amazon probably never will be.

Better still to just run the workloads on a regional service provider that lives in your own legal jurisdiction and not take the risk. You'll be less likely to sued into oblivion, probably get better service and you won't be putting your testicles in the vice of a convicted monopolist! Win/win/win.