As of my understanding we can use jarsigner with AWS cloud HSM for signing apk or aab files, AWS won't support apksigner for signing apps instead use jarsigner.

example:

jarsigner -keystore example_keystoreRSA.store -signedjar app_signed.aab -sigalg sha512withrsa -storetype CloudHSM -storepass <password> -keypass <password> -J-classpath '-J/opt/cloudhsm/java/*' -J-Djava.library.path=/opt/cloudhsm/lib /tmp/app-release.aab <signing_key_lable>

https://docs.aws.amazon.com/cloudhsm/latest/userguide/third_java-sdk_integration.html
https://docs.aws.amazon.com/cloudhsm/latest/userguide/java-library-install_5.html