AWS CloudHSM
AWS CloudHSM is an Amazon Web Services service that provides dedicated, single-tenant hardware security modules (HSMs) in the customer’s own Virtual Private Cloud. Unlike AWS Key Management Service (KMS), which is a shared, multi-tenant managed service, CloudHSM is the choice when an organization must directly control the HSM and hold sole access to its keys.
Key points
- HSMs are single-tenant and, for clusters running in FIPS mode, validated to FIPS 140-2 Level 3 or FIPS 140-3 Level 3 depending on the HSM type; clusters can alternatively run in non-FIPS mode for algorithms outside those validation restrictions, but a cluster’s mode cannot be changed after creation.
- Customers get complete control over key generation, storage, import, export, and use — including symmetric keys, asymmetric key pairs, and session/token keys — with data-plane traffic end-to-end encrypted and not visible to AWS.
- Because AWS cannot see the data plane, the customer takes on user management responsibilities outside of IAM, in exchange for that control.
- Supports standard cryptographic interfaces — PKCS #11, Java Cryptography Extension (JCE), Microsoft CNG, and Key Storage Provider (KSP) — so applications built on those standards can migrate with minimal changes.
- Common use cases: encrypting data at rest, offloading SSL/TLS handshakes, operating a private certificate authority’s signing keys, and storing Oracle Transparent Data Encryption (TDE) keys.
- AWS automates HSM cluster management — high availability, backups, provisioning, and maintenance — while leaving cryptographic control with the customer.
- Contrast with KMS: choose KMS for a managed service with AWS-run, multi-tenant HSMs; choose CloudHSM when compliance or policy requires a dedicated, single-tenant HSM you administer directly and where AWS holds no access to your keys.
- For managed payment HSMs specifically, AWS offers a separate service, AWS Payment Cryptography, rather than CloudHSM.