AWS CloudHSM

What it is

AWS CloudHSM provides dedicated, single-tenant HSM (Hardware security module)A tamper-resistant hardware device that creates and stores cryptographic keys and uses them without ever exposing them. AWS KMS uses HSMs internally; AWS CloudHSM gives you dedicated HSMs that you control.Glossary entry (HSMs) in the AWS Cloud. An HSM is a device that performs cryptographic operations and stores keys securely. With CloudHSM you get complete control of the HSMs, the keys, and the users, while AWS handles provisioning, backups, configuration, and maintenance.

Choose CloudHSM when a question requires single-tenant HSMs, full control of keys and algorithms that AWS can't access, standard crypto API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry for applications being migrated, or compliance that a shared managed service can't meet. For most encryption in AWS services, AWS KMS is simpler and integrates directly.

Concepts

Cluster: a set of HSMs that CloudHSM keeps in sync. Place HSMs in different AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry for availability. A cluster can have 1 to 28 HSMs, with a default quota of 6 per account per AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry.
Cluster modes:
- FIPS (Federal Information Processing Standards)US government standards for computer systems. FIPS 140-3, and the earlier FIPS 140-2, set security requirements for cryptographic modules, such as the hardware security modules behind AWS KMS and AWS CloudHSM.Glossary entry mode: only FIPS-validated keys and algorithms, on HSMs validated to FIPS 140-2 or FIPS 140-3 Level 3.
- Non-FIPS mode: all supported keys and algorithms.
End-to-end encryption: the data plane is not visible to AWS. You manage HSM users, outside of IAM. The trade-off is more responsibility than with a managed service: if you lose the credentials, AWS can't recover your keys.
Standard interfaces: PKCS #11, Java Cryptography Extension (JCE), and Microsoft CNG and KSP, so existing applications can move with few changes.
Backups: CloudHSM periodically backs up users, keys, and policies. Data is encrypted inside the HSM before it leaves, and AWS can't decrypt the backups.

Use cases

Regulatory compliance that requires dedicated, validated HSMs, such as PCI DSS (Payment Card Industry Data Security Standard)The security standard for organizations that store, process, or send payment card data. AWS is assessed as a PCI DSS Level 1 service provider, but each customer is still responsible for the compliance of what it builds.Glossary entry, PCI PIN, and PCI 3-D Secure.
TLS (Transport Layer Security)The protocol that encrypts traffic between a client and a server and lets the server prove its identity with a certificate. It replaced SSL, though the older name is still common; HTTPS is HTTP over TLS.Glossary entry offload: web servers offload TLS processing, with the private keys kept in the HSM.
Custom key store for KMS: back KMS keys with your own CloudHSM cluster, to use KMS's integrations while keys live in HSMs you control.
Certificate authorities, digital signing, Oracle TDE, and other workloads that need keys in an HSM.

Security, resilience, performance, and cost

Security: single tenancy, your own users, and keys that AWS can't access. CloudTrail records CloudHSM API calls, and HSM audit logs go to CloudWatch Logs.
Resilience: run at least two HSMs in different Availability Zones; backups let you restore clusters.
Performance: add HSMs to a cluster to scale cryptographic throughput.
Cost: no upfront costs; pay an hourly fee for each HSM until you terminate it, which is much more than KMS keys. To save money, delete HSMs you don't need and restore the cluster from a backup later.

CloudHSM or KMS?

	AWS CloudHSM	AWS KMS
Tenancy	Single-tenant HSMs	Multi-tenant managed service
Who manages users and keys	You	AWS manages the service; you control key policies
Integration with AWS services	Through a KMS custom key store, or your own applications	Native in most AWS services
APIs	PKCS #11, JCE, CNG/KSP	AWS KMS API
Cost	Per HSM-hour	Per key per month plus requests
Choose when	Dedicated HSMs or full key control are required	Most encryption needs

Reverse mindmap: when the question points here

Is it AWS CloudHSM?

Yes, when the question says
- Dedicated, single-tenant HSM leads to CloudHSM
- AWS must not have access to the keys leads to CloudHSM
- Application uses PKCS #11 or JCE leads to CloudHSM
- Offload SSL/TLS from web servers leads to CloudHSM SSL offload
- KMS integration but keys in our own HSMs leads to CloudHSM custom key store
Run it well
- Highly available HSMs leads to Two or more HSMs in different AZs
- Only FIPS-validated algorithms leads to FIPS mode cluster
No, when the question says
- Simple encryption for S3 or EBS leads to KMS

Key takeaways

CloudHSM gives you single-tenant HSMs (FIPS 140-2 or 140-3 Level 3 in FIPS mode) in clusters across Availability Zones.
You manage the HSM users and keys; AWS can't see your data or decrypt your backups.
It supports PKCS #11, JCE, and CNG/KSP for application integration, and can back KMS as a custom key store.
It is priced per HSM-hour; use KMS unless dedicated HSMs or full key control are required.