Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS CloudHSM provides dedicated hardware security modules (HSMs) for generating, storing, and using cryptographic keys. The key architectural distinction from AWS Key Management Service (AWS KMS) is the level of control: CloudHSM gives the customer control of a dedicated HSM cluster and its key material, while KMS is a highly integrated, AWS-managed key management service.
The correct choice depends on compliance requirements, control of cryptographic operations, third-party application compatibility, and the need to integrate directly with AWS services.
Key Concepts
What AWS CloudHSM Provides
AWS CloudHSM is a managed cloud service that provisions HSM appliances in an Amazon VPC. The HSMs use dedicated hardware rather than a shared, multitenant key store. Customers can:
- Generate and use encryption keys inside the HSM.
- Control access to keys and cryptographic operations.
- Use industry-standard cryptographic interfaces and third-party applications.
- Keep AWS from having visibility into the key material stored in the HSM.
- Meet requirements for dedicated, validated hardware security modules.
CloudHSM is commonly associated with FIPS 140-2 Level 3 validated hardware. Always verify the current AWS documentation and applicable certification scope when a question depends on a specific compliance version.
CloudHSM Runs in the Customer VPC
CloudHSM cluster nodes are deployed into subnets in the customer VPC. Applications connect to the HSM over the VPC network, subject to the required routing and security controls.
A resilient design generally places HSMs in multiple Availability Zones. The HSM cluster and its capacity remain customer design concerns even though AWS operates the underlying managed service.
Customer Control and Root of Trust
With CloudHSM, the customer controls the HSM and the keys it contains. This can be important when a policy requires exclusive control of cryptographic key material or when an external application must interact directly with an HSM.
AWS KMS provides strong security, but its underlying HSM infrastructure and root of trust are AWS managed. KMS is therefore usually simpler to operate and easier to integrate with AWS services.
CloudHSM as a KMS Custom Key Store
AWS KMS can use a CloudHSM cluster as a custom key store. This design combines:
- CloudHSM control over the HSMs protecting the key material.
- KMS APIs, policies, auditing, and integration with supported AWS services.
This is useful when an organization needs stronger control over the HSM but still wants AWS services to consume KMS keys through native integrations.
Representative Use Cases
CloudHSM can be appropriate for workloads that require direct HSM access or specialized cryptographic compatibility, such as:
- Protecting a private key used by an internal certificate authority.
- Offloading SSL/TLS cryptographic processing from application or web servers.
- Protecting Oracle Transparent Data Encryption (TDE) master keys.
- Supporting third-party applications that require standard HSM interfaces.
- Providing the HSM backing for a KMS custom key store.
Exam-Relevant Takeaways
- Choose CloudHSM when the requirement emphasizes dedicated hardware, customer control of the HSM, direct HSM access, or third-party cryptographic compatibility.
- Choose AWS KMS when the priority is straightforward managed key management and native integration with AWS services such as Amazon S3, Amazon EBS, Amazon RDS, and other encryption-enabled services.
- CloudHSM is deployed in the customer VPC; KMS is an AWS regional service accessed through AWS APIs and service integrations.
- CloudHSM is generally described as single-tenant, while KMS uses AWS-managed, multitenant infrastructure.
- A KMS custom key store backed by CloudHSM is the hybrid answer when the scenario requires both customer-controlled HSMs and KMS integration.
- CloudHSM does not automatically become the best choice merely because the requirement says “highly secure.” KMS also provides strong security and is usually operationally simpler.
- High availability requires appropriate cluster design, including HSMs in multiple Availability Zones and consideration of connectivity and capacity.
Architecture Decision Guide
| Requirement | Recommended choice | Reason |
|---|---|---|
| Native encryption integration across many AWS services | AWS KMS | KMS is directly integrated with AWS services and supports IAM and key policies. |
| Dedicated HSM hardware and customer-controlled cryptographic keys | AWS CloudHSM | The customer controls the HSM cluster and key material. |
| Direct access from a third-party application using standard HSM interfaces | AWS CloudHSM | CloudHSM offers broader third-party application support than KMS. |
| Protecting a CA private key | AWS CloudHSM | The private key can remain within a dedicated HSM. |
| Oracle TDE master-key protection | AWS CloudHSM | This is a common HSM-based database encryption use case. |
| Customer-controlled HSM plus AWS service integration | KMS custom key store backed by CloudHSM | Combines CloudHSM protection with KMS integration. |
| Lowest operational complexity for common AWS encryption needs | AWS KMS | AWS manages the HSM infrastructure and KMS provides service-level integration. |
Common Exam Traps
- Assuming KMS and CloudHSM are interchangeable: KMS is primarily a managed key management and integration service; CloudHSM provides customer-controlled HSMs.
- Selecting CloudHSM solely for availability: Both services support highly available designs. The differentiator is control, dedicated hardware, and compatibility—not simply availability.
- Forgetting AWS service integration: Many AWS services integrate directly with KMS but not directly with CloudHSM. A custom key store may address this requirement.
- Treating CloudHSM as serverless or fully hands-off: AWS manages the service infrastructure, but customers must plan cluster size, Availability Zone placement, networking, users, and operational procedures.
- Confusing encryption keys with key policies: KMS offers AWS-native policy and service integration. CloudHSM gives more direct control over HSM users and cryptographic operations, but application integration must be designed.
- Assuming AWS can recover CloudHSM keys: CloudHSM is designed so AWS does not have access to customer key material. Key backup, recovery, and lifecycle procedures must be planned carefully.
Real-World Engineer Notes
- Use private subnets and tightly scoped security-group and network controls for HSM connectivity.
- Place HSM nodes across multiple Availability Zones when the workload requires regional resilience.
- Plan capacity before production. HSM throughput and cryptographic operation limits can affect sizing, especially for TLS offload or transaction-heavy workloads.
- Separate administrative access from application access and follow least privilege for HSM users.
- Test backup, restore, replacement, and disaster-recovery procedures before depending on CloudHSM for a certificate authority or database master key.
- For common AWS encryption, KMS is often the better default because it reduces operational burden. CloudHSM should be selected for a clear control, compliance, or compatibility requirement.
- A custom key store introduces additional dependencies between KMS and the CloudHSM cluster. Include cluster availability and connectivity in operational monitoring and incident procedures.
Quick Reference Summary
- CloudHSM: Dedicated HSMs in the customer VPC, customer-controlled keys, direct HSM access, broad third-party support.
- KMS: AWS-managed key management, simpler operations, IAM and key-policy integration, broad AWS service integration.
- CloudHSM security level: Commonly associated with FIPS 140-2 Level 3 validated hardware.
- Best hybrid option: KMS custom key store backed by CloudHSM.
- Primary decision question: Does the workload need dedicated HSM control and direct cryptographic access, or does it mainly need simple AWS-native encryption integration?
Flashcards
- Q: What is the primary architectural difference between CloudHSM and KMS?
A: CloudHSM provides customer-controlled, dedicated HSM appliances, while KMS is an AWS-managed key management service.
- Q: Where are CloudHSM cluster nodes deployed?
A: In subnets within the customer’s Amazon VPC.
- Q: Why might an organization choose CloudHSM over KMS?
A: It may require dedicated hardware, direct HSM access, exclusive control of key material, or third-party application compatibility.
- Q: Which service usually provides better native integration with AWS services?
A: AWS KMS.
- Q: What is a KMS custom key store?
A: A KMS key store backed by a customer-controlled CloudHSM cluster.
- Q: What compliance hardware level is commonly associated with CloudHSM?
A: FIPS 140-2 Level 3 validated HSM hardware.
- Q: Name one use case for storing a key in CloudHSM.
A: Protecting a certificate authority private key or an Oracle TDE master key.
- Q: Does CloudHSM automatically provide multi-AZ resilience?
A: No. The cluster should be designed with HSM nodes in multiple Availability Zones when resilience is required.
- Q: Which service is generally simpler for standard AWS encryption requirements?
A: AWS KMS.
- Q: What does customer control mean in the CloudHSM context?
A: The customer manages HSM users, cryptographic operations, and key material inside the HSM; AWS does not have visibility into the keys.
Practice Questions
Question 1
A financial application uses a commercial cryptographic library that requires direct access to a FIPS-validated HSM through standard HSM interfaces. The company also requires that AWS personnel cannot access the application’s private keys. Which solution best meets these requirements?
A. AWS KMS customer managed keys
B. AWS CloudHSM
C. Amazon S3 server-side encryption with S3-managed keys
D. AWS Secrets Manager
Correct answer: B. AWS CloudHSM
CloudHSM provides dedicated HSM hardware, direct HSM access, broad third-party compatibility, and customer control of the key material. KMS is more integrated with AWS services but does not provide the same direct HSM control model.
Question 2
A company wants to encrypt data in Amazon S3, Amazon EBS, and Amazon RDS using centrally managed keys. The company has no requirement for direct HSM access or exclusive control of dedicated HSM hardware. Which service should be recommended?
A. AWS CloudHSM
B. AWS KMS
C. A self-managed HSM on Amazon EC2
D. AWS Certificate Manager only
Correct answer: B. AWS KMS
KMS provides native integration with many AWS services and avoids the additional operational responsibilities of managing an HSM cluster. CloudHSM is unnecessary when direct HSM control is not a requirement.
Question 3
An organization must retain control of the HSMs protecting its KMS keys but wants to use AWS services that integrate with KMS. Which architecture should it use?
A. Store plaintext keys in AWS Secrets Manager
B. Use a KMS custom key store backed by AWS CloudHSM
C. Use only CloudHSM and configure each AWS service to connect directly to it
D. Use S3 server-side encryption with S3-managed keys
Correct answer: B. Use a KMS custom key store backed by AWS CloudHSM
A custom key store combines CloudHSM-based key protection and customer control with KMS APIs and AWS service integrations. Direct CloudHSM integration is not available for every AWS service.
Question 4
A solution architect deploys a CloudHSM cluster with one HSM in a single Availability Zone. The workload is business-critical and must continue operating after an Availability Zone failure. What should the architect do?
A. Replace CloudHSM with an internet-facing HSM
B. Add HSM nodes in additional Availability Zones and validate application failover
C. Store a copy of the plaintext keys in Amazon S3
D. Disable HSM authentication to improve availability
Correct answer: B. Add HSM nodes in additional Availability Zones and validate application failover
CloudHSM resilience depends on the cluster design, Availability Zone placement, networking, and application behavior. A single node in one Availability Zone creates a single-AZ dependency.
Question 5
A company wants to protect the private key of its internal certificate authority. It requires that the key cannot be exported from the cryptographic boundary and that the CA software can use an HSM interface. Which service is the best fit?
A. AWS CloudHSM
B. Amazon S3 with SSE-S3
C. Amazon RDS encryption
D. AWS KMS alias management only
Correct answer: A. AWS CloudHSM
CloudHSM is designed for dedicated HSM-based protection of sensitive private keys and supports applications that require direct HSM interfaces. KMS aliases and storage encryption features do not provide the same CA HSM integration model.