AWS KMS (Key Management Service) and AWS CloudHSM both use Hardware Security Modules (HSMs) for cryptographic operations, but the control model, compliance level, and operational responsibilities are very different.

1. Control & Key Ownership

• KMS: AWS manages the HSM infrastructure. You control keys at a logical level (create, rotate, disable) but can’t access the HSMs directly. Keys are stored in AWS-managed HSMs, and AWS handles HA, scaling, and patching.

• CloudHSM: You get a dedicated, single-tenant HSM cluster. You control the HSMs at the hardware level, are the only one with access to keys, and AWS cannot see or recover your key material.

2. Compliance & Isolation

• KMS: Backed by FIPS 140-2 Level 3 validated HSMs, but multi-tenant. Meets most compliance needs like PCI DSS, HIPAA, and FedRAMP.

• CloudHSM: Also FIPS 140-2 Level 3 validated but single-tenant and dedicated to you. Required when regulations demand physical key isolation and sole administrative control.

3. Use Cases

• KMS: Simplifies key management for AWS services (S3, RDS, EBS, Lambda). Ideal for most applications that need encryption without managing hardware.

• CloudHSM: For custom cryptographic operations, legacy applications using PKCS#11/JCE/CNG, or integrations outside AWS where you need direct HSM access.

4. Cost & Management

• KMS: Pay per API request and key storage. Low operational overhead.

• CloudHSM: Hourly per-HSM instance cost plus operational work — you handle clustering, backups, client integration, and scaling.

In short:

KMS = AWS-managed convenience & integration.
CloudHSM = full control & compliance-grade isolation.

For a deeper, scenario-based breakdown (including when organizations switch from KMS to CloudHSM), see:
Cloud HSM vs KMS – Strategic Guide