ACKF logoACKF
Security, Identity, and Compliance

AWS CloudHSM

View on GitHub

AWS CloudHSM

AWS CloudHSM provides dedicated hardware security module (HSM) appliances that you provision into your Amazon VPC to generate and store cryptographic keys and perform cryptographic operations. It exposes standard cryptographic APIs such as PKCS#11, Java JCE, and Microsoft CNG so customer applications can perform operations inside the HSM. It normally fits into an AWS architecture as a VPC-hosted, regional HSM cluster used by EC2-based applications or by AWS Key Management Service as a custom key store for customer-controlled keys.

🗂 Resource Category

Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Dedicated HSM + customer key custody + VPC placement = AWS CloudHSM"

📖 Ownership

Classification: Shared Responsibility Service

AWS responsibilities: AWS operates and maintains the physical HSM appliances, the underlying service control plane, network connectivity to the HSM endpoints, and the availability of the managed HSM cluster; AWS is responsible for the physical security of the data centers and the managed service platform that exposes HSM endpoints. AWS secures and maintains the hardware infrastructure and service control APIs used to provision and manage HSM clusters. AWS performs maintenance and patching of the physical infrastructure and the managed service components that host the HSM appliances.

Customer responsibilities: The customer configures and manages HSM cluster membership, HSM user accounts, key creation and deletion, cryptographic operations performed inside the HSM, client-side libraries and drivers, and application integration. The customer is responsible for securing access to HSM client endpoints, the key lifecycle (generation, rotation, destruction), audit and logging configuration, monitoring, backups of any exported or wrapped keys (when allowed), and any application-level secrets. The customer monitors HSM usage, performance, and access patterns and integrates HSM events with CloudTrail or other logging and alerting tools where appropriate.

Patching responsibilities: AWS patches and maintains the physical infrastructure and the managed service platform components that host the HSM appliances, and AWS is responsible for HSM appliance hardware and firmware maintenance as part of the managed service. Hypervisor patching is not applicable to the HSM appliance presentation layer; patching of guest operating systems is not applicable because customers do not run guest OS on the HSM appliance. The customer is responsible for patching and maintaining client-side libraries, SDKs, application runtimes, application dependencies, and any customer-deployed applications that use the HSM.

🏗 Typical Architecture

💡 Top 5 Features

  • Provisioned single-tenant hardware security modules accessible from within a customer VPC.
  • Support for industry-standard cryptographic APIs such as PKCS#11, Java JCE, and Microsoft CNG for in-HSM operations.
  • User-controlled key material where private keys can be generated and kept inside HSMs rather than exported in plaintext.
  • Ability to deploy HSMs as a clustered service across Availability Zones for resilience of cryptographic operations.
  • Integration option to act as a backing key store for AWS Key Management Service custom key stores.

✅ Top 5 Use Cases

  • Storing and using private keys for TLS/SSL termination and certificate private key protection on application servers.
  • Hosting high-value cryptographic keys for payment processing or other regulated transaction systems requiring HSM-backed key custody.
  • Providing an HSM-backed root for internally run certificate authorities or code-signing infrastructure to keep keys in hardware.
  • Using CloudHSM as the backing key store for an AWS KMS custom key store when an application requires direct HSM control over key material.
  • Performing high-throughput cryptographic operations in hardware to offload sensitive key operations from application hosts.

🏗 Architecture Placement

AWS CloudHSM is deployed into an Amazon VPC and presents HSM endpoints that EC2-based applications, on-premises systems over secure connectivity, or AWS KMS (as a custom key store) can call to perform cryptographic operations. It is a regional service with HSM appliances placed in Availability Zones, and client applications connect to HSM cluster endpoints over the VPC network. Proper network placement, security group and route configuration, and authentication of HSM users are typical operational considerations.

🎯 Commonly Used With

- Amazon VPC
- Amazon EC2
- AWS Key Management Service
- AWS CloudTrail
- Amazon CloudWatch

🌍 5 Real-World Examples

  • A bank provisions CloudHSM clusters in a VPC to generate and store PIN encryption keys and to perform HSM-backed cryptographic operations for transaction processing, meeting operational key custody requirements.
  • A healthcare provider stores master encryption keys in CloudHSM to protect patient records, using HSM-based keys to meet regulatory guidance for hardware-backed key custody.
  • A payment processor uses CloudHSM to host keys used by a tokenization service, keeping private keys inside HSMs to satisfy audit and compliance controls.
  • A technology company runs an internal certificate authority with private keys protected in CloudHSM to perform code-signing and certificate issuance with hardware-protected keys.
  • A government agency uses CloudHSM to isolate and control access to high-value cryptographic keys while logging all HSM administration and usage for audit purposes.

🎓 AWS Exam Clues

  • When a requirement specifies dedicated HSM hardware and customer-controlled key custody, consider AWS CloudHSM.
  • When applications require PKCS#11, Java JCE, or Microsoft CNG compatibility and keys must remain inside hardware, CloudHSM is a candidate.
  • When compliance or regulation mandates hardware-backed key storage with auditable HSM operations, CloudHSM is commonly considered.
  • When you need keys to be generated and used inside HSMs and not exported in plaintext, CloudHSM addresses that operational requirement.
  • When integrating with AWS KMS is required but customer wants direct control of the backing HSM key material, use a KMS custom key store backed by CloudHSM.

📝 Quick Revision

AWS CloudHSM provides customer-dedicated hardware security modules in your VPC for generating and using keys inside hardware. Use it when you need hardware-backed key custody, PKCS#11/JCE/CNG compatibility, and careful network and operational control; plan for VPC placement, client integration, monitoring, and operational overhead.

🏷 Keywords

HSM • Hardware security module • PKCS#11 • Java JCE • Microsoft CNG • Clustered HSM • Amazon VPC • Customer key control • KMS custom key store • Key material custody • FIPS 140-2 Level 3 • Cryptographic offload