Amazon bolsters AWS customer security with Cloud Hardware Security Modules (CloudHSM)-- a service handling the creation and management of encryption keys on the cloud.
The HSMs in question are physical devices (connected either externally or inside servers as PCI cards) equipped with tamper-proofing or tamper-alerting tools taking care of encryption duties outside of more vulnerable server memory and storage systems.
Previously the use of HSMs (demanded by a number of government agences) with Amazon services demanded the installation of appliances on local machines.
Amazon claims CloudHSM provides access to dedicated HSM appliances isolated from other AWS customers and allows one to "securely generate, store, and manage the cryptographic keys used for data encryption such that they are accessible only by [the user]."
The service however demands the use of the Virtual Private Cloud Service, which provides a private network atop Amazon infrastructure.
