AWS CloudHSM (Hardware Security Module)
- What it is
- Dedicated, single-tenant hardware security module (HSM) in the AWS Cloud.
- FIPS 140-2 Level 3 validated. You have exclusive control; AWS cannot access your keys.
- When it is the answer
- Regulatory or contractual requirement that no third party, including AWS, can access the key material.
- Need for industry-standard APIs: PKCS#11, JCE, Microsoft CNG.
- Offloading SSL/TLS processing, running your own certificate authority, or Oracle TDE with customer-managed keys.
- The cost of that control
- You manage the HSM cluster, users, and key backups. Lose your credentials and AWS cannot recover your keys.
- Not to be confused with
- AWS Key Management Service (KMS) — multi-tenant, fully managed, far simpler, integrated with every AWS service. The default choice unless a regulation forces CloudHSM.