CloudHSM

Question 1

What AWS cryptographic service is used to create and maintain Hardware Security Modules (HSMs) in the AWS environment?

Answer 1

AWS CloudHSM (single-tenant, AWS-provisioned, fully customer-managed HSMs)

Question 2

What computing devices process cryptographic operations and provide secure storage for cryptographic keys?

Answer 2

Hardware Security Modules (HSMs)

Question 3

How do AWS CloudHSM and AWS KMS differ in FIPS 140-2 compliance? A:

Answer 3

• CloudHSM: FIPS 140-2 Level 3 compliant (overall)
• KMS - FIPS 140-2 Level 2 (overall)

Question 4

How can AWS CloudHSM be accessed?

Answer 4

• Industry-standard cryptographic APIs PKCS#11
• Java Cryptography Extension (JCE)
• Microsoft CryptoNG (CNG)

AWS KMS operations are performed via the AWS Standard API

Question 5

Can AWS CloudHSM be deployed into the customer VPC?

Answer 5

No, CloudHSM is deployed into a separate AWS-managed VPC, HSM instances are exposed to the customer VPC via network interfaces

Question 6

Is AWS CloudHSM highly available by default?

Answer 6

No, requires at least two deployments in each Availability Zones for High Availability

Question 7

How can EC2 instances access AWS CloudHSM?

Answer 7

Via the CloudHSM client installed on the EC2 instances

Question 8

Can AWS access the secure HSM area where key material is stored?

Answer 8

No, AWS provisions CloudHSM but has no access to the HSM secure area

Question 8

Can AWS KMS integrate with AWS CloudHSM?

Answer 8

Yes, AWS KMS can use CloudHSM as a custom key store

Question 8

When would AWS CloudHSM be an appropriate choice?

Answer 8

When requirements include:
- Single-tenant Hardware Security Module
- FIPS 140-2 Level 3 overall compliance
- Access via industry-standard APIs (PKCS#11, JCE, CNG)

Question 8

What are the main use cases for AWS CloudHSM service?

Answer 8

AWS CloudHSM is commonly used for:
- Implementing client-side encryption
- Offloading SSL/TLS processing from web servers
- Enabling Transparent Data Encryption (TDE) for databases such as Oracle
- Protecting the private key of an issuing Certificate Authority (CA)