CloudHSM

CloudHSM is a managed hardware security module service from Amazon Web Services. It provides dedicated cryptographic hardware in the AWS cloud to generate, store, and use keys in a secure environment. Keys remain within the HSM boundary, and cryptographic operations are performed inside the hardware, with key material never exposed to the host system.

The service offers standard interfaces such as PKCS#11, Java Cryptography Extension (JCE), and Microsoft Cryptographic API (CNG), enabling existing applications to perform encryption, decryption, signing, and key management using HSM-backed keys. Keys generated in CloudHSM can be created inside the HSM or imported, and they can be rotated and managed within the cluster as part of cryptographic workflows.

CloudHSM supports clusters that span multiple Availability Zones for high availability and disaster recovery. Integrations with AWS IAM, CloudTrail, and CloudWatch provide access control, auditing, and monitoring, while networking options include VPC connectivity and AWS Direct Connect for secure connections to on‑premises environments.

Typical use cases include securing private keys for public key infrastructure (PKI), safeguarding TLS keys for web servers and load balancers, code signing, and encryption key management for databases and applications. CloudHSM is designed to meet regulatory and security requirements and is FIPS-validated, with AWS responsible for infrastructure security and ongoing compliance assessments.