AWS KMS vs CloudHSM: Which key management option fits?
Choose based on the cryptographic interface and operational control your workload actually needs. AWS KMS is usually the simpler fit for managed encryption across AWS services; CloudHSM fits workloads that require a dedicated HSM and direct control of cryptographic operations.
Start with the integration requirement
When an AWS service such as S3, EBS, or RDS needs customer-managed encryption keys, start with AWS KMS. It provides a managed key API, authorization through IAM and key policies, audit integration, and broad integration with AWS services.
Choose AWS CloudHSM when an application must use HSM interfaces or algorithms that KMS does not expose, or when your requirement calls for a single-tenant HSM that your team manages. That choice brings responsibility for cluster capacity, availability, users, credentials, and backups.
- KMS: managed key lifecycle and straightforward integration with supported AWS services.
- CloudHSM: dedicated HSMs and more direct control, with more operational work.
- KMS custom key store: keep the KMS API and supported AWS service integrations while storing key material in a CloudHSM cluster you manage.
Know what a CloudHSM-backed KMS key changes
A CloudHSM key store is a KMS custom key store associated with a CloudHSM cluster in your account. KMS still handles the KMS interface and authorization; cryptographic operations for those keys run in the connected cluster.
The custom key store adds cluster dependencies. If it is disconnected, its KMS keys cannot perform cryptographic operations. AWS documents feature limits for custom key stores, so check those limits before selecting one.
A practical decision rule
If the requirement says “encrypt data in an AWS service with customer-managed keys,” prefer KMS unless another constraint is stated. If it requires direct HSM interfaces, dedicated single-tenant HSM control, or cryptographic capabilities not offered by KMS, evaluate CloudHSM. If the workload also needs KMS-integrated AWS services but key material must reside in CloudHSM, evaluate a KMS custom key store.
Common questions
Does AWS KMS store keys in software instead of an HSM?
AWS documents that KMS key material is protected by validated hardware security modules and is not exposed unencrypted. A KMS customer-managed key does not by itself mean you operate a dedicated CloudHSM cluster.
Can a CloudHSM key store still work with AWS services that integrate with KMS?
Yes, for AWS services that support customer-managed KMS keys. The custom key store connects KMS to your CloudHSM cluster, subject to the documented feature and service limitations.