Auditors ask a city whether it needs dedicated HSM appliances under its exclusive control for a small set of regulated keys, while most application encryption can stay on managed CMKs. How should the architect decide between AWS CloudHSM and AWS KMS?
Select an answer to reveal the explanation.
Short Explanation
Most city apps are fine with KMS CMKs—managed keys with good policies. Reach for CloudHSM when auditors demand a dedicated HSM you effectively control, not because “HSM” sounds cooler. Dumping plaintext masters in Parameter Store is not cryptography.
Full Explanation
AWS KMS customer managed keys cover the majority of encryption-at-rest and envelope-encryption designs. CloudHSM is appropriate when compliance requires dedicated, single-tenant HSM control beyond standard KMS. Replacing all KMS usage, relying solely on AWS-owned keys for regulated cases that need customer control, or storing plaintext masters without KMS/HSM protection are poor designs.