2

Have a doubt about about how AWS KMS handles their asymmetrical/symmetrical keys. Does AWS KMS use Hardware Security Modules (HSMs) underneath by default? (cant find documentation that prove/dissmiss the fact).

I saw that it is possible to create a custom key store and connect to your dedicated HSM in the cloud (AWS HSM). However, AWS HSM is expensive and low level. If AWS KMS already by default handled its keys in an HSM, it would bring a huge cost reduction. Saw that Google Cloud KMS does exactly this (you can choose HSM as protection level) and you pay per key usage.

Is it possible to have something similar to Google Cloud KMS in AWS?

Improve this question

1 Answer 1

Reset to default
1

AWS KMS FAQ states that by default HSMs are used for Customer Managed Keys (CMK). Other option is to use AWS's CloudHSM as you have mentioned in the question.

The key material for a CMK is generated within hardware security modules (HSMs) managed by AWS KMS. You can also have the key material generated and used in an AWS CloudHSM cluster as a part of the custom key store feature in AWS KMS

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .