AWS CloudHSM cost: dedicated hardware security modules by the hour

Quick answer

CloudHSM bills per HSM instance-hour (around $1.45, roughly $1,000+ per month each), and production high availability needs at least two HSMs across AZs, so a real deployment starts around $2,000+/month. It provides dedicated, single-tenant, FIPS-validated hardware for strict compliance and key-custody requirements. For the vast majority of workloads, KMS (which uses HSMs under the hood at a fraction of the cost) is the right, far cheaper choice.

AWS CloudHSM provides dedicated, single-tenant hardware security modules for cryptographic operations and key storage. It is priced per HSM by the hour, and because that hardware is dedicated to you, it is expensive, especially since production requires a cluster of at least two for high availability.

Per HSM, and you need at least two

Aspect	Detail
Per HSM instance	~$1.45/hour (~$1,000+/month)
High availability	At least 2 HSMs across AZs
Realistic minimum	~$2,000+/month for a production cluster

Each HSM instance costs about $1.45 an hour, over $1,000 a month. A single HSM is a single point of failure, so production deployments run a cluster of two or more across Availability Zones, putting the realistic minimum around $2,000+ a month. There is no scaling to zero; the HSMs run continuously.

CloudHSM vs KMS

The key comparison is with KMS. KMS is a managed, multi-tenant key service, backed by HSMs, that costs $1 per key per month plus a few cents per 10,000 requests, orders of magnitude cheaper than CloudHSM. For the vast majority of encryption and key-management needs, KMS is the right choice. CloudHSM is for the specific cases where you need single-tenant, dedicated, FIPS 140-2 Level 3 hardware under your sole control, strict compliance regimes, specific key-custody requirements, or workloads that need direct HSM access.

Controlling CloudHSM cost

First, confirm you genuinely need CloudHSM rather than KMS, which handles most requirements at a tiny fraction of the cost. If you do need it, right-size the cluster to the minimum HSMs for your availability and throughput requirements (do not over-provision HSMs), and consider KMS custom key stores backed by CloudHSM if that hybrid fits. The dominant cost lever is not needing CloudHSM at all, so the decision is requirement-driven: only strict compliance and key-custody needs justify the dedicated-hardware price.

FAQ

How is AWS CloudHSM priced?

Per HSM instance-hour, around $1.45 (roughly $1,000+ per month each). Production high availability requires a cluster of at least two HSMs across Availability Zones, so a realistic deployment starts around $2,000+ per month. The HSMs run continuously with no scaling to zero.

Why is CloudHSM so expensive?

Because it provides dedicated, single-tenant hardware security modules reserved solely for you, unlike the shared, managed KMS. Each HSM costs over $1,000 a month, and production needs at least two for high availability. Dedicated FIPS-validated hardware under your sole control is inherently more expensive than a multi-tenant managed service.

CloudHSM or KMS?

KMS for the vast majority of needs, it is a managed, HSM-backed key service costing $1 per key per month plus a few cents per 10,000 requests, orders of magnitude cheaper. CloudHSM is only for strict compliance, key-custody, or workloads needing single-tenant, dedicated FIPS 140-2 Level 3 hardware under your sole control.

When do I need CloudHSM instead of KMS?

When you have strict compliance requirements mandating single-tenant, dedicated hardware, specific key-custody requirements where keys must be under your sole control, or workloads needing direct HSM access. For general encryption and key management, KMS handles it at a tiny fraction of the cost, so CloudHSM is requirement-driven.

How do I reduce CloudHSM cost?

First confirm you genuinely need it rather than KMS, which meets most requirements far more cheaply. If you do need CloudHSM, right-size the cluster to the minimum HSMs for your availability and throughput needs rather than over-provisioning. The biggest lever is not needing dedicated HSM hardware at all.

Does C3X estimate CloudHSM cost?

C3X prices the CloudHSM cluster and HSM resources from your Terraform, so the per-HSM hourly cost and cluster total appear before deploy. Whether you need CloudHSM versus far-cheaper KMS is a compliance and key-custody decision you make against your requirements.

What to do next

Catch dedicated-hardware cost before you deploy. C3X reads your Terraform and prices CloudHSM and the rest of your stack against a live catalog. Start with the quickstart.