CloudHSM

Question 1

CloudHSM

Answer 1

• • is a dedicated physical machine/appliance isolated in order to store security keys and other types of encryption keys used within an application.
• • the key is used within the domain of the HSM appliance instead of being exposed outside the appliance.

Question 2

Special security mechanisms to make them more secure:

Answer 2

• security key is used only within HSM
• an HSM Client is used to expose the APIs of the HSM.
• so an application can communicate with HSM to do the encryption or decryption of the data that we are requesting.
• • is physically isolated from other resources
• • Tamper resistance(build to notify via advanced logging).
• on AWS, engineers have NO access to the keys.
• • If the keys are lost or reset, you will never be able to access the data stored in the appliance.

Question 3

Some types of keys that might be stored on HSMs

Answer 3

keys used to encrypt file systems
keys used to encrypt databases
keys used to provide DRM
used with S3 encryption.

Question 4

When to use CloudHSM instead of somethign like key management service?

Answer 4

• • when it is required.

- - not even AWS engineers have access to the keys in the cloudHSM applicance, only access to “manage” the appliance.