Encryption with KMS And CloudHSM
AWS offers multiple managed services for data encryption and key management. Two of the most important are:
- AWS Key Management Service (KMS)
- AWS CloudHSM (Hardware Security Module)
They both provide secure key management but have different control models and use cases.
AWS Key Management Service (KMS)
A fully managed key management service integrated with almost all core AWS services.
Key Features:
- Managed Service: AWS manages the underlying HSM infrastructure.
- Customer Master Keys (CMKs) / KMS Keys:
- Symmetric (AES-256) and asymmetric keys supported.
- Can be AWS managed, customer managed, or imported.
- Integration: Directly integrates with S3, EBS, RDS, DynamoDB, Lambda, CloudTrail, and more (encryption at rest).
- Automatic Key Rotation: For customer-managed keys, optional yearly rotation.
- Auditability: CloudTrail logs each key use.
- Cost-Effective: Pay per API call and per key.
Use Cases:
- Encrypting S3 buckets, EBS volumes, RDS snapshots.
- Envelope encryption: Generate data keys for applications.
- Centralized and simple encryption with minimal operations burden.
AWS CloudHSM
A managed, dedicated Hardware Security Module (HSM) that complies with FIPS 140‑2 Level 3.
Key Features:
- Customer Ownership: Customers have exclusive control of HSMs and cryptographic keys. AWS cannot access your keys.
- Open Standards: Supports PKCS#11, JCE, and CNG interfaces for integration.
- Flexibility: You can import, generate, and manage keys with your specific cryptographic algorithms.
- Compliance: Required for strict regulatory use cases (financial, healthcare, government).
- Clustered & Scalable: You can build highly available HSM clusters in a VPC.
Use Cases:
- Applications requiring exclusive control and regulatory compliance.
- Managing keys for custom PKI / Certificate Authorities.
- Storing keys for payment systems (PCI DSS, financial apps).
- Integration with 3rd‑party or legacy applications needing PKCS#11 APIs.
KMS vs CloudHSM – Key Differences
Feature | AWS KMS | AWS CloudHSM |
|---|---|---|
Management | Fully managed by AWS | Customer-controlled dedicated hardware |
Key Control | Shared responsibility (AWS manages infra) | Exclusive access, AWS cannot view/use keys |
Ease of Use | Highly integrated with AWS services | Requires more setup and client integration |
APIs | AWS API / SDK | PKCS#11, JCE, CNG, OpenSSL |
Compliance | FIPS 140‑2 Level 2 | FIPS 140‑2 Level 3 |
Best For | General-purpose encryption in AWS | Strict compliance & custom cryptography use |
Cost & Complexity | Lower cost, very easy to use | Higher cost, more administrative overhead |