> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/aws-saa-c02/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/aws-saa-c02/security-and-encryption/cloudhsm.md).

# CloudHSM

* CloudHSM is a **cloud-based hardware security module (HSM)** that enables you to **easily generate and use your own encryption keys on AWS**.<br>
* With CloudHSM, you can **manage your own encryption keys using FIPS 140-2 Level 3 validated HSMs**.<br>
* CloudHSM offers you the flexibility to **integrate with your applications using industry-standard APIs**, such as PKCS#11, Java Cryptography Extensions (JCE), and Microsoft CryptoNG (CNG) libraries.<br>
* CloudHSM is **standards-compliant and enables you to export all of your keys to most other commercially-available HSMs**, subject to your configurations.<br>
* It is **a fully-managed service** that automates time-consuming administrative tasks for you, such as hardware provisioning, software patching, high-availability, and backups.<br>
* CloudHSM also **enables you to scale quickly by adding and removing HSM capacity on-demand**, with no up-front costs.<br>
* CloudHSM **provides hardware security modules (HSMs) in a cluster**.
  * A cluster is a **collection of individual HSMs that CloudHSM keeps in sync**.<br>
  * You can **think of a cluster as one logical HSM**.<br>
  * When you create the HSMs **in different AWS Availability Zones**, you automatically **get high availability**.