A financial services firm faces a regulatory requirement to hold cryptographic keys on dedicated single-tenant hardware security modules (HSMs). Which AWS service satisfies this?
Show answer and explanation
Answer: B
CloudHSM provisions physical HSM appliances that are exclusively one customer's — single-tenant, untouched by other tenants, and under the customer's own cryptographic control. When regulation demands dedicated certified hardware rather than a shared-key service, meeting it requires actual isolated devices, which is precisely what CloudHSM delivers.
Why the other options are wrong
- A. KMS is built on shared, multi-tenant HSM capacity under AWS's control — robust for most workloads but not dedicated or single-tenant, so it fails the regulatory condition.
- C. Secrets Manager stores and rotates credentials such as passwords and API keys; it is not a cryptographic key store on dedicated hardware.
- D. Certificate Manager issues and manages SSL/TLS certificates, an entirely different function from hardware key storage.