Cloudhsm

Basics

• AWS Provisioned but fully customr managed
• Cloud HSM is FIPS 140-2 Level 3 compliant. KMS is overall all Level 2 compliant and partially Level 3 compliant
• While KMS is accessed using AWS APIs & governed by IAM, Cloud HSM is less integrated with AWS
• For HSM Industry Standard APIS like PKCS#11, Java Croptographic Extensions(JCE), Microsoft CryptoNG(CNG) are used
• KMS can use Cloud HSM as a custom keystore.
• Cloud HSM is deployed in Cloud HSM VPC which is managed by AWS
• HSM is a physical device that runs in one AZ. So for high availability one device needs to be deployed in each AZ and part of a cluster
• HSM are injected inside customer VPC as ENI
• Cloud HSM clients instance need to be installed on compute instances that want to use Cloud HSM
• AWS has no access to areas where Cloud HSM is installed. Only customer administrator has access to it