Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss the fact).
I saw that it is possible to create a custom key store and connect to your dedicated HSM in the cloud (AWS HSM). However, AWS HSM is expensive and low level. If AWS KMS already by default handled its keys in an HSM, it would bring a huge cost reduction. Saw that Google Cloud KMS does exactly this (you can choose HSM as protection level) and you pay per key usage.
Is it possible to have something similar to Google Cloud KMS in AWS?