What Services Does Amazon Web Services (AWS) Provide?

Amazon Web Services (AWS) is a cloud computing platform that provides on-demand compute, storage, databases, networking, and data-security services. Its two core services for cryptographic key management are AWS Key Management Service (KMS) and AWS CloudHSM, both validated at FIPS 140-3 Security Level 3.

AWS delivers hundreds of cloud services, but for data protection the two that matter most are AWS KMS and AWS CloudHSM. AWS KMS is a managed, multi-tenant service that generates and controls encryption keys inside AWS-operated hardware security modules. AWS CloudHSM gives you a dedicated, single-tenant HSM that only you can access. Both now hold FIPS 140-3 Level 3 validation.

Key Takeaways

• AWS KMS and AWS CloudHSM are AWS’s two cryptographic key-management services. KMS is managed and multi-tenant; CloudHSM is dedicated and single-tenant.
• AWS KMS HSMs are validated at FIPS 140-3 Security Level 3, certified by NIST in February 2025. Older content citing FIPS 140-2 Level 2 for KMS is out of date.
• AWS KMS supports 256-bit symmetric keys, RSA (2048/3072/4096), ECC (P-256, P-384, P-521, SECG P-256k1, Ed25519), HMAC, and SM2 in China Regions.
• AWS KMS now supports post-quantum ML-DSA (FIPS 204) signing with the ML-DSA-44, ML-DSA-65, and ML-DSA-87 key specs.
• A symmetric KMS key encrypts up to 4096 bytes per call; larger payloads use envelope encryption with a KMS-protected data key.

What Is Amazon Web Services (AWS)?

AWS is Amazon’s cloud computing platform, offering compute, storage, databases, analytics, machine learning, content delivery, and security services on demand.

Organizations use AWS to build and run applications without owning physical infrastructure, paying only for what they consume. AWS operates data centers across global regions and availability zones, which supports low latency and high availability. It is one of the three largest cloud providers alongside Microsoft Azure and Google Cloud Platform. For data security specifically, AWS centers on two services covered below: AWS KMS and AWS CloudHSM.

AWS KMS vs AWS CloudHSM: Which Key Service to Use

AWS KMS is a managed, multi-tenant key service; AWS CloudHSM is a dedicated, single-tenant HSM you control directly.

Both services store keys in tamper-resistant hardware from which plaintext keys cannot be exported, and both are FIPS 140-3 Level 3 validated. The difference is control and access model. With KMS, AWS runs the HSMs and you drive them through an API. With CloudHSM, you initialize the cluster with your own crypto-officer credentials and reach the hardware through PKCS#11, JCE, OpenSSL, or the Windows CNG and KSP providers, and AWS cannot access your keys.

Attribute	AWS KMS	AWS CloudHSM
Tenancy	Managed, multi-tenant	Dedicated, single-tenant
FIPS validation	FIPS 140-3 Level 3 (Feb 2025)	FIPS 140-3 Level 3 (hsm2m.medium); older hsm1.medium was 140-2 Level 3
Access	AWS API and SDK	PKCS#11, JCE, OpenSSL, CNG/KSP
Who controls keys	You control keys; AWS operates HSMs	You control keys and HSMs; AWS has no access
Algorithm range	Curated FIPS-approved subset	Wider algorithm range via PKCS#11
Best for	Most encryption use cases, envelope encryption, AWS service integration	Custom algorithms, direct hardware access, PKI root of trust

AWS KMS reaching Level 3 validation, first under FIPS 140-2 in May 2023 and then under FIPS 140-3 in February 2025, removed a long-standing reason to run CloudHSM. Customers who previously needed CloudHSM only to meet Level 3 can now satisfy that requirement with KMS alone.

AWS KMS Key Types, Algorithms, and Limits

AWS KMS supports symmetric keys, asymmetric RSA and ECC key pairs, HMAC keys, post-quantum ML-DSA keys, and SM2 keys in China Regions.

KMS Key Types

AWS KMS supports 256-bit symmetric keys and asymmetric RSA keys of 2048, 3072, and 4096 bits. Key material is generated inside the HSM using a NIST SP 800-90A CTR_DRBG seeded with 384 bits of entropy. Each KMS key has one fixed key spec and one key usage that cannot change after creation. In China Regions, the default symmetric key is a 128-bit key that uses SM4 encryption.

Encryption and Signing Algorithms

For asymmetric encryption, KMS uses RSA-OAEP. For signing and verification it supports RSA-PSS, RSA-PKCS#1 v1.5, ECDSA, and EdDSA. The supported elliptic curves are NIST P-256, P-384, P-521, SECG P-256k1, and Ed25519. Symmetric encryption uses AES in Galois/Counter Mode (AES-GCM). ECC keys sign and verify or derive shared secrets, but a single key cannot do both.

Post-Quantum Signing (ML-DSA, FIPS 204)

AWS KMS supports ML-DSA, the NIST post-quantum digital signature standard published as FIPS 204 in August 2024. The supported key specs are ML-DSA-44, ML-DSA-65, and ML-DSA-87, all using the ML-DSA-SHAKE-256 signing algorithm. This lets you sign with quantum-resistant algorithms while classical RSA and ECC keys stay in service. Separately, AWS-LC FIPS added ML-KEM (FIPS 203) for post-quantum key encapsulation.

Plaintext Size Limits

A symmetric KMS key encrypts up to 4096 bytes of plaintext in a single Encrypt call. Asymmetric limits are much smaller and depend on the key and hash: RSA-2048 with SHA-256 tops out at 190 bytes, from the formula (key_size_in_bits / 8) minus (2 times hash_length_in_bits / 8) minus 2. For larger data, use envelope encryption, where KMS protects a data key that encrypts the payload locally.

Bring Your Own Key (BYOK)

AWS KMS lets you import your own key material for symmetric, HMAC, and asymmetric RSA and ECC KMS keys. You wrap the key material under a public wrapping key that KMS provides, then import the wrapped key. This gives you control over key generation and retention outside AWS. Check the current AWS KMS documentation for supported wrapping algorithms, since these are updated over time.

FIPS 140-3 Compliance in AWS KMS and CloudHSM

AWS KMS and AWS CloudHSM both operate HSMs validated at FIPS 140-3 Security Level 3 under the NIST Cryptographic Module Validation Program.

AWS KMS HSMs were certified at FIPS 140-3 Level 3 in February 2025, after holding FIPS 140-2 Level 3 from May 2023 and Level 2 continuously since 2017. AWS CloudHSM reaches FIPS 140-3 Level 3 on the hsm2m.medium instance type, generally available since August 2024 and built on Marvell LiquidSecurity hardware. The older hsm1.medium instance was FIPS 140-2 Level 3 and reached end-of-life on December 1, 2025; AWS began automatic migration of hsm1 clusters to hsm2 starting April 2025, and NIST moved the hsm1.medium certificate to the CMVP historical list on January 4, 2026. In China Regions, AWS KMS uses OSCCA-certified HSMs rather than FIPS-validated ones.

Common Use Cases for AWS Key Management

AWS KMS and CloudHSM protect keys across storage encryption, application signing, TLS, and public key infrastructure.

• Storage and database encryption: KMS keys encrypt data at rest in S3, EBS, RDS, DynamoDB, and other AWS services through envelope encryption.
• Digital signing: Asymmetric KMS keys sign software, documents, and messages; recipients verify with the public key, including outside AWS.
• TLS private key protection: CloudHSM stores TLS private keys in dedicated FIPS 140-3 Level 3 hardware for websites hosted in the cloud.
• PKI root of trust: CloudHSM can act as the root of trust for a private PKI, protecting the CA private key in hardware.
• Post-quantum signing: ML-DSA keys in KMS let teams begin quantum-resistant signing for long-lived artifacts.
• External and custom key stores: KMS custom key stores back KMS keys with CloudHSM or an external key manager you control.

How Encryption Consulting Helps

Encryption Consulting’s Cloud Data Protection Services help you design and operate key management across AWS KMS, CloudHSM, and hybrid key stores. The team assesses your AWS environment, maps keys and algorithms to compliance requirements such as FIPS 140-3 and PCI DSS, and builds a migration path toward post-quantum algorithms like ML-DSA and ML-KEM. Encryption Consulting’s AWS Data Protection Service then implements and validates the design against your business goals. The work is backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What are the main AWS services for data security?

AWS provides two core services for cryptographic key management. AWS Key Management Service (KMS) is a managed, multi-tenant service that creates and controls keys inside FIPS 140-3 Security Level 3 validated HSMs. AWS CloudHSM is a single-tenant service that gives you dedicated FIPS 140-3 Level 3 hardware you alone control. AWS also offers storage encryption, TLS in transit, and IAM access control around both.

Is AWS KMS FIPS 140-2 or FIPS 140-3 validated?

AWS KMS HSMs are validated at FIPS 140-3 Security Level 3, certified by NIST in February 2025. Before that, KMS held FIPS 140-2 Security Level 3 (from May 2023) and Level 2 (from 2017). Older content citing FIPS 140-2 Level 2 for KMS is out of date. Customers who previously needed CloudHSM only to reach Level 3 can now meet that requirement with KMS alone.

What is the difference between AWS KMS and AWS CloudHSM?

AWS KMS is a managed multi-tenant service where AWS operates the HSMs and you control the keys through an API. AWS CloudHSM gives you a dedicated single-tenant HSM that only you access, reachable through PKCS#11, JCE, OpenSSL, or the Windows CNG and KSP providers. Both are FIPS 140-3 Level 3 validated. CloudHSM suits custom algorithms, direct hardware access, and acting as a PKI root of trust.

What key types and algorithms does AWS KMS support?

AWS KMS supports 256-bit symmetric keys and asymmetric RSA keys of 2048, 3072, and 4096 bits. For elliptic curve it supports NIST P-256, P-384, P-521, SECG P-256k1, and Ed25519. Encryption uses RSA-OAEP; signing uses RSA-PSS, RSA-PKCS#1 v1.5, ECDSA, and EdDSA. KMS also supports HMAC keys and, for post-quantum signing, ML-DSA (FIPS 204) with ML-DSA-44, ML-DSA-65, and ML-DSA-87.

Does AWS support post-quantum cryptography?

Yes. AWS KMS supports ML-DSA (FIPS 204), the NIST post-quantum digital signature standard published in August 2024, with the ML-DSA-44, ML-DSA-65, and ML-DSA-87 key specs using the ML-DSA-SHAKE-256 signing algorithm. AWS-LC FIPS also added ML-KEM (FIPS 203) for key encapsulation. This lets organizations begin signing and key exchange with quantum-resistant algorithms while classical RSA and ECC remain in use.

How large a plaintext can AWS KMS encrypt in one call?

A symmetric AWS KMS key can encrypt up to 4096 bytes of plaintext in a single Encrypt call. Asymmetric RSA keys hold less: for RSA-2048 with SHA-256 the limit is 190 bytes, following the formula (key_size_in_bits / 8) minus (2 times hash_length_in_bits / 8) minus 2. For larger data, use envelope encryption, where KMS protects a data key that encrypts the payload locally.

Protect Your Data in the Cloud

Ready to secure your AWS keys end to end? Protect your data in the cloud with Cloud Data Protection Services, or talk to an Encryption Consulting advisor.