AWS Certified Data Analytics Specialty 2021 – Hands-On - Cloud HSM Overview

The video tutorial explains AWS Cloud HSM, a hardware security module that differs from KMS by providing dedicated encryption hardware managed by the user. It highlights Cloud HSM's features, including high security, compliance, and availability across multiple zones. The tutorial covers supported encryption types and integration with services like Redshift and S3. It emphasizes the user's responsibility for key management and the role of IAM in managing HSM clusters.

What is the primary difference between KMS and Cloud HSM?

• KMS is managed by AWS, while Cloud HSM is managed by the user.

• KMS is free, while Cloud HSM has a cost.

• KMS provides hardware, while Cloud HSM provides software.

• KMS supports asymmetric encryption, while Cloud HSM does not.

Which of the following is a feature of Cloud HSM?

• It is managed entirely by AWS.

• It only supports symmetric encryption.

• It is not tamper-resistant.

• It supports both symmetric and asymmetric encryption.

Why is it important to manage your own keys when using Cloud HSM?

• AWS manages the keys for you.

• AWS can recover your keys if you lose them.

• Keys are automatically backed up by AWS.

• You have full control and AWS cannot access or recover your keys.

Which AWS service is mentioned as integrating with Cloud HSM for database encryption?

• DynamoDB

• Lambda

• Redshift

• EC2

What can IAM permissions do in relation to Cloud HSM?

• Manage encryption keys within HSM.

• Create, read, update, and delete an HSM cluster.

• Provide free tier access to Cloud HSM.

• Automatically manage user security within HSM.