CloudHSM 这个产品是通常是用于什么场景？和 KMS 有什么分别吗？

[pythonee]

安全小白，用过的同学能否帮忙解释下

[paulw54jrn]

搬运工。
KMS 经常用，CloudHSM 没接触过..

Q: How does AWS Key Management Service (KMS) compare to AWS CloudHSM?

AWS Key Management Service (KMS) is a multi-tenant, managed service that allows you to use and manage encryption keys. Both services offer a high level of security for your cryptographic keys. AWS CloudHSM provides a dedicated, FIPS 140-2 Level 3 HSM under your exclusive control, directly in your Amazon Virtual Private Cloud (VPC).

[paulw54jrn]

Q: When should I use AWS CloudHSM instead of AWS KMS?

You should consider using AWS CloudHSM if you require:

Keys stored in dedicated, third-party validated hardware security modules under your exclusive control.
FIPS 140-2 compliance.
Integration with applications using PKCS#11, Java JCE, or Microsoft CNG interfaces.
High-performance in-VPC cryptographic acceleration (bulk crypto).

[pythonee]

@paulw54jrn 后面确实也翻到了，第一时间没读完，感谢

[julyclyde]

@paulw54jrn 感觉这意思主要是合规性要求？