CloudHSM

Question 1

What is the difference between CloudHSM and Key Management Service (KMS)?

Answer 1

Your part of KMS is isolated, but KMS is still shared between customers.

AWS has some level of access to. KMS.

CloudHSM is a true single tenant Hardware Security Module (HSM). It is AWS provision, but fully customer managed.

KMS is FIPS 140-2 Level 2 while CloudHSM is Level 3.

KMS uses AWS integrations for access. CloudHSM uses industry standard APIs.

Question 2

Is CloudHSM highly available by default?

Answer 2

No. It runs in a single AZ. You have to create a cluster across multiple AZs to implement HA.

Question 3

Can you use CloudHSM for S3 server-side encryption?

Answer 3

No. It has no native AWS integration. It can be used to perform client-side encryption before data is sent to S3, but it cannot be used by S3 to perform server-side encryption.

Question 4

What single tenant service can be used to offload SSL/TLS processing for web servers?

Answer 4

CloudHSM.

Question 5

What capability does CloudHSM provide for Oracle databases?

Answer 5

CloudHSM enables Transparent Data Encryption (TDE) for Oracle databases.

Question 6

What capability does CloudHSM provide to Certificate Authorities (CA)?

Answer 6

It can be used to protect private keys that are used to issue certificates.