Servisphere
AWS CloudHSM icon (AWS Architecture Icons)

AWS CloudHSM

Dedicated hardware HSM

Provides dedicated HSM devices (FIPS 140 level 3) in your VPC; you have full control over keys and users, and AWS cannot access your keys.

  • Cost$$$ High
  • Difficulty●●●●●
  • Costs money when idle?Yes
  • Managed by AWS
  • In examsSAA · SOA · DVA

Scope: AZ (cluster spans multiple AZs)

Open CloudHSM on the map →
Think of it asLike renting a private safe deposit box where only you hold the key, while the bank just guards the building.

When to use it

✓ Use it when

Regulations require exclusive key control, or you need PKCS#11/JCE/CNG.

✗ Avoid it when

Ordinary encryption integrated with AWS services → KMS.

Common uses

  • Storing the private key of an internal CA
  • SSL/TLS offload for web servers
  • Custom key store for KMS

What does it cost?

  • Pricing model: Charged hourly for each running HSM.
⚠️ Cost traps

You need at least 2 HSMs in 2 AZs for HA, so the cost doubles.

Reference prices for us-east-1, updated October 14, 2026; they may have changed. Always check the AWS pricing page.

Related services

SAA-C03 study guide

CloudHSM is covered in these study modules:

Open CloudHSM on the map →