Security Specialty
AWS KMS vs CloudHSM: Differences and When to Use Each
AWS KMS is the managed service for creating and controlling encryption keys, with keys protected by FIPS 140-3 Security Level 3 validated hardware security modules. AWS CloudHSM gives you dedicated, single-tenant HSMs that you control, with more flexibility in algorithms and key lengths.
KMS vs CloudHSM at a glance
| Feature | AWS KMS | AWS CloudHSM |
|---|---|---|
| Model | AWS managed service to create and control the keys used to encrypt and sign your data. KMS keys never leave AWS KMS unencrypted. | Hardware security modules in the AWS cloud that you control, with AWS automating HSM management such as backups, provisioning, configuration and maintenance. |
| Hardware | KMS keys are protected by FIPS 140-3 Security Level 3 validated HSMs. | General-purpose, single-tenant HSMs; FIPS 140-2 or 140-3 level 3 validated for clusters in FIPS mode. |
| Flexibility | A fully managed AWS service. The CloudHSM documentation contrasts HSMs with fully managed services that have predetermined algorithms and key lengths. | More flexibility than fully managed services with predetermined algorithms and key lengths. |
| Modes | Not applicable. | FIPS and non-FIPS clusters. In FIPS mode only FIPS-validated keys and algorithms can be used. |
Source: docs.aws.amazon.com/cloudhsm/latest/userguide/introduction.html
Sources: AWS KMS overview and What is AWS CloudHSM?.
How the exam frames the choice
This is a study tip based on the facts above. Questions usually contrast managed convenience with dedicated, single-tenant control. If the scenario stresses a managed service integrated with other AWS services, think KMS. If it stresses a dedicated HSM that you control, or algorithm and key-length flexibility, think CloudHSM. The exam guide lists both under Data Protection (task 5.2.1: selecting the appropriate encryption key service such as CloudHSM or KMS).
KMS custom key stores: where the two meet
KMS can use CloudHSM through a custom key store. The KMS documentation also covers external key stores. Custom key stores change a few rules the exam likes to test:
- KMS keys in custom key stores are not eligible for automatic or on-demand rotation; you rotate them manually by creating a new key.
- You cannot import key material into KMS keys in custom key stores.
- When you schedule deletion of a key in a CloudHSM key store, it becomes unusable right away, and AWS KMS makes a best effort to delete key material from the cluster. Cluster backups can still contain it.
More in AWS KMS: key policies, rotation and deletion.
KMS facts to keep in mind
- A KMS key policy does not automatically give the account access: without the root-principal statement, IAM policies that allow use of the key are ineffective.
- Key deletion needs a waiting period of 7 to 30 days (30 by default), and disabling a key is the reversible alternative.
- Automatic rotation defaults to 365 days and only applies to symmetric encryption keys with AWS_KMS key material.
Practice these in Domain 5: Data Protection and the practice test.
Frequently asked questions
Can AWS KMS use CloudHSM?
Yes. AWS KMS supports custom key stores, including a CloudHSM key store, and KMS keys in custom key stores are manually rotated.
Is CloudHSM single-tenant?
Yes. AWS describes CloudHSM HSMs as general-purpose, single-tenant and FIPS 140-2 or 140-3 level 3 validated for clusters in FIPS mode.
Do KMS keys leave AWS KMS unencrypted?
No. KMS keys are created, managed, used and deleted entirely within AWS KMS and never leave the service unencrypted.
Can I import key material into a key in a custom key store?
No. AWS KMS does not support importing key material into KMS keys in custom key stores.
Sources
- AWS Key Management Service overview (AWS)
- What is AWS CloudHSM? (AWS)
- Rotate AWS KMS keys (AWS)
- Delete an AWS KMS key (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
Secrets Manager vs Parameter Store: Which to Use?
Secrets Manager or Systems Manager Parameter Store? Compare purpose, rotation and encryption, plus AWS's own recommendation for storing secrets.
2 min read - Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read - Security Specialty
AWS Security Specialty Exam Tips: 12 Must-Know Facts
12 facts and tactics for SCS-C03 test day: scoring, unscored questions, time per question, question types, retakes and managing the clock.
2 min read