What is AWS CloudHSM?
AWS CloudHSM provides dedicated hardware security modules (HSMs) in the AWS cloud. Unlike AWS KMS, CloudHSM gives you single-tenant hardware where only you have access to the cryptographic keys. The HSMs are FIPS 140-2 Level 3 certified and meet the highest compliance requirements.
Key Features
- Dedicated single-tenant HSM hardware
- FIPS 140-2 Level 3 certification
- Full control over cryptographic keys
- Integration with AWS KMS as Custom Key Store
- Cluster mode for high availability
Common Use Cases
Regulatory Compliance: Industries like financial services, healthcare, and public sector require dedicated HSMs for cryptographic operations. CloudHSM meets FIPS 140-2 Level 3, PCI DSS, and HIPAA requirements.
Private Key Management: Store private keys for SSL/TLS, code signing, or document signing in HSMs. Keys never leave the hardware and are not accessible even to AWS employees.
Database Encryption: Oracle TDE (Transparent Data Encryption) and Amazon Redshift can use CloudHSM for key management, meeting compliance requirements.
Benefits
- Highest security certification (FIPS 140-2 Level 3)
- Full key control without AWS access
- Dedicated hardware without multi-tenancy risks
- Integration with existing PKI infrastructure
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS CloudHSM: compliance assessment, HSM cluster architecture, integration with existing applications, and migration from on-premises HSMs.
Typical Use Cases
Frequently Asked Questions
What does AWS CloudHSM cost?
CloudHSM costs approximately $1.60 per hour per HSM instance (about $1,150 per month). For high availability, you need at least two HSMs in different Availability Zones.
What is the difference between CloudHSM and AWS KMS?
KMS is a multi-tenant service with a simple API and AWS-managed keys. CloudHSM provides dedicated single-tenant hardware with full key control and FIPS 140-2 Level 3 certification.
Which compliance standards does CloudHSM meet?
CloudHSM is FIPS 140-2 Level 3 certified and supports PCI DSS, HIPAA, FedRAMP, and eIDAS. The HSMs are manufactured by Gemalto (Thales).
Can I integrate CloudHSM with AWS services?
Yes, CloudHSM integrates with AWS KMS (Custom Key Store), Amazon RDS (Oracle TDE), Amazon Redshift, and SSL/TLS offloading for web servers.