# CloudHSM

* CloudHSM provides **hardware security modules in AWS**.\\

* A **hardware security module (HSM) is a computing device that processes cryptographic operations and provides secure storage for cryptographic keys**.

* **When you use a HSM from AWS CloudHSM**, you can perform a variety of cryptographic tasks:

  * **Generate, store, import, export, and manage cryptographic keys**, including symmetric keys and asymmetric key pairs.
  * **Use symmetric and asymmetric algorithms to encrypt and decrypt data**.
  * Use **cryptographic hash functions to compute message digests and hash-based message authentication codes** (HMACs).
  * **Cryptographically sign data** (including code signing) and verify signatures.
  * **Generate cryptographically secure random data**.

* A **cluster is a collection of individual HSMs that CloudHSM keeps in sync**.\\

* You can **create a cluster that has from 1 to 28 HSMs** (the default limit is 6 HSMs per AWS account per AWS Region).\\

* **You can place the HSMs in different Availability Zones** in an AWS Region. **Adding more HSMs to a cluster provides higher performance**. **Spreading clusters across Availability Zones provides redundancy and high availability**.\\

* **If you want a managed service for creating and controlling your encryption keys, but you don't want or need to operate your own HSM, consider using AWS KMS**.

![](https://40640462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MQ39nPAiP6LTprAFu1T%2F-MSkAAmfW2lovzh3PTJK%2F-MSpW1OwYJXkpbVeIezq%2Fimage.png?alt=media\&token=08d5e527-55f1-4a91-9ed4-12db9b6f77c6)
