Exploring CloudHSM

AWS CloudHSM is another managed service for data encryption. Being fully managed, many aspects of implementing and maintaining the HSM are abstracted, such as hardware provisioning, patching, and backups. CloudHSM also has the great advantage of automatically scaling on demand.

HSM stands for Hardware Security Module. It is specialized security hardware validated to FIPS 140-2 Level 3. HSMs can be used to generate and create your own encryption keys.

CloudHSM is required when you and your organization warrant additional control and administrative power over your encryption compared with KMS. Although KMS is supported by its own FIPS-enabled HSM, you have no control over those modules. Further, AWS cannot access your keys or any cryptographic material within your HSMs.

With certain compliance and regulatory requirements, you will be obliged to use an HSM to generate your keys or an HSM might be required to be used as a cryptographic key store. In addition...