What is AWS CloudHSM?
AWS CloudHSM provides dedicated, single-tenant hardware security modules (HSMs) in the AWS cloud. Unlike AWS KMS, CloudHSM gives you hardware that only you have access to. AWS handles provisioning, backups, configuration, and maintenance of the clusters, while the cryptographic operations and data remain invisible to AWS itself.
The current instance type, hsm2m.medium, is FIPS 140-3 Level 3 validated; the older hsm1.medium was FIPS 140-2 Level 3 certified (that certificate has moved to the historical list, and AWS recommends migrating to hsm2m.medium). The HSM hardware is based on Marvell technology.
Key Features
- Dedicated single-tenant HSM hardware in FIPS or non-FIPS cluster mode
- FIPS 140-3 Level 3 validation (current hsm2m.medium instance type)
- Full control over cryptographic keys and algorithms
- Integration with AWS KMS as a Custom Key Store
- Cluster mode for high availability across multiple Availability Zones
- Compatibility with PKCS#11, JCE, CNG, and KSP for straightforward migration
Common Use Cases
Regulatory Compliance: Industries like financial services, healthcare, and the public sector require dedicated HSMs for cryptographic operations. CloudHSM meets FIPS 140 Level 3 validation, PCI DSS, PCI PIN, and PCI-3DS.
Private Key Management: Store private keys for SSL/TLS, code signing, or document signing in HSMs. Keys never leave the hardware and are not visible to AWS.
Database Encryption: Oracle TDE (Transparent Data Encryption) and Amazon Redshift can use CloudHSM for key management, meeting compliance requirements.
Benefits
- High security certification per FIPS 140-3 Level 3
- Full key control without AWS access to the data plane
- Dedicated hardware without multi-tenancy risks
- Integration with existing PKI infrastructure
Integration with innFactory
As an AWS Reseller, innFactory supports you with AWS CloudHSM: compliance assessment, HSM cluster architecture, integration with existing applications, and migration from on-premises HSMs.
Typical Use Cases
Frequently Asked Questions
What does AWS CloudHSM cost?
CloudHSM is billed hourly per running HSM instance, with no upfront costs. For high availability, at least two HSMs in different Availability Zones are recommended. Current prices are listed on the official pricing page.
What is the difference between CloudHSM and AWS KMS?
KMS is a multi-tenant service with a simple API and AWS-managed keys. CloudHSM provides dedicated single-tenant hardware with full key control and FIPS 140 Level 3 validation.
Which compliance standards does CloudHSM meet?
The current instance type, hsm2m.medium, is FIPS 140-3 Level 3 certified; the older hsm1.medium type was FIPS 140-2 Level 3 certified. CloudHSM is also PCI DSS, PCI PIN, and PCI-3DS compliant, and SOC 2 audited.
Can I integrate CloudHSM with AWS services?
Yes, CloudHSM integrates with AWS KMS as a Custom Key Store, with Amazon RDS (e.g., Oracle TDE) and Amazon Redshift for key management, and for SSL/TLS offloading on web servers.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of AWS (official documentation). This page does not represent an offer by AWS.