AWS › AWS KMS & Data Encryption
How does AWS CloudHSM differ from KMS, and when would an organization need the additional control it provides?
AdvancedAnswer
AWS CloudHSM provides dedicated, single tenant hardware security modules that give you complete, exclusive control over the cryptographic keys and hardware, meeting certain strict regulatory or compliance requirements that specifically mandate the use of dedicated hardware security modules, whereas KMS uses shared multi tenant hardware managed entirely by AWS, which is sufficient and far simpler for the vast majority of use cases but does not offer the same level of exclusive physical control that some highly regulated industries specifically require.
aws cloudhsmv2 create-cluster --hsm-type hsm1.medium --subnet-ids subnet-12345Real-world example A payment processing company operating under strict regulatory requirements that mandate dedicated hardware security modules uses CloudHSM instead of standard KMS, satisfying an auditor's specific requirement for exclusive, non shared cryptographic hardware.