What is Cloud HSM?
Cloud HSM provides fully managed hardware security modules in Google Cloud. The HSMs are FIPS 140-2 Level 3 certified and store encryption keys in tamper-proof hardware. The service is accessible via Cloud KMS API.
Core Features
- FIPS 140-2 Level 3: Highest security certification for cloud HSMs
- Cloud KMS integration: Same API as Cloud KMS, with HSM backend
- Regional keys: Keys stay in the chosen region
- Automatic scaling: No capacity planning needed
- Audit logging: Complete audit trail of all key operations
Common Use Cases
Regulatory Compliance
Industries like financial services or healthcare often require HSM-protected keys for compliance with PCI-DSS, HIPAA, or other standards.
Customer-Managed Encryption
Encrypt BigQuery, Cloud Storage, and other services with HSM keys. Control over encryption remains with the customer.
Code Signing and PKI
Securely store asymmetric keys in HSM for code signing, certificate issuance, or other PKI operations.
Benefits
- No own HSM hardware to operate
- Same API as Cloud KMS
- Automatic key lifecycle management
- Strict compliance certifications
Integration with innFactory
As a Google Cloud Partner, innFactory supports you with Cloud HSM: architecture, key management strategy, compliance consulting, and migration.
Available Tiers & Options
Standard
- FIPS 140-2 Level 3
- Managed by Google
- Cloud KMS integration
- Keys in Google HSM
Typical Use Cases
Technical Specifications
Frequently Asked Questions
What is Cloud HSM?
Cloud HSM provides hardware security modules in Google Cloud. Keys are stored in FIPS 140-2 Level 3 certified HSMs.
How does Cloud HSM differ from Cloud KMS?
Cloud KMS stores keys in software, Cloud HSM in certified hardware modules. HSM is for strict compliance requirements.
Which key types does Cloud HSM support?
Cloud HSM supports symmetric (AES-256) and asymmetric keys (RSA, EC) for encryption and signing.
Is Cloud HSM available in EU regions?
Yes, Cloud HSM is available in multiple EU regions. Keys can be created region-specifically.
Can I use Cloud HSM for CMEK?
Yes, HSM keys can be used as Customer-Managed Encryption Keys for all GCP services with CMEK support.
