A regulated bank is migrating payment processing to AWS. Auditors require single-tenant hardware key storage, customer-exclusive control of key material, and FIPS 140-3 Level 3 validated modules. Shared multi-tenant key services are prohibited. Which key management design meets the dedicated hardware requirement?
Select an answer to reveal the explanation.
Short Explanation
You've got auditors who won't accept shared hardware, so you need your own vault. CloudHSM gives you single-tenant HSMs where only you hold the keys, like a safe-deposit box bank staff can't open.
Full Explanation
The correct design satisfies all three auditor constraints together because a CloudHSM cluster provides single-tenant hardware appliances in dedicated tenancy, FIPS 140-3 Level 3 validated modules, and separation where only customer-owned HSM users create and use key material so the provider has no access. The KMS design with customer-managed keys and rotation remains incorrect for this regulated workload because standard KMS is a shared multi-tenant service even with strong IAM and rotation, so it cannot meet the prohibition on shared services or the dedicated hardware mandate despite being best practice for general workloads. The dedicated cluster configured for FIPS 140-2 Level 2 is also incorrect because auditors explicitly require FIPS 140-3 Level 3 validation, and a lower or older validation does not transfer even when tenancy and customer control are correct. The dedicated cluster with provider-managed administration fails the customer-exclusive control principle because allowing external administrators to hold custody or manage users breaks exclusive ownership and auditability even though hardware isolation is preserved. Exam caveat is to distinguish hardware tenancy from key policy control, as granular IAM and rotation do not convert a multi-tenant service into dedicated hardware and FIPS 140-2 does not satisfy FIPS 140-3. Practical check is to verify cluster attestation documents, HSM firmware certification numbers, and that all crypto-user credentials and quorum authentications are generated and held solely within the bank.