808bits

AWS Key Management Service HSM

FIPS 140-2 certificate #3009 · Amazon Web Services, Inc. · data as of 2026-09-15

AWS Key Management Service HSM, from Amazon Web Services, Inc., holds FIPS 140-2 certificate #3009 at overall level 2. The validation is historical: agencies may keep the module in existing systems but not buy it new. Below are its validation history, algorithm certificates and security policy, drawn from the NIST CMVP entry.

Historical. SP 800-56Arev3 transition. Federal agencies may reference historical validations for existing systems only, not for new procurement.
Caveat: When installed, initialized and configured as specified in Section 3 of the Security Policy

Certificate

Certificate number3009
StandardFIPS 140-2
Statushistorical
Overall level2
Module typeHardware
EmbodimentMulti-Chip Stand Alone
VendorAmazon Web Services, Inc. · website
Hardware versions2.0
Firmware versions1.3.6

Module description

Quoted from the NIST CMVP entry for this certificate.

The Amazon AWS Key Management Service HSM is a multi-chip standalone hardware cryptographic appliance designed to provide dedicated cryptographic functions to meet the security and scalability requirements of the AWS Key Management Service (KMS). The cryptographic boundary is defined as the secure chassis of the appliance. All key materials are maintained exclusively in volatile memory in the appliance and are erased immediately upon detection of physical tampering.

Security level exceptions

  • Cryptographic Module Specification: Level 3
  • Roles, Services, and Authentication: Level 3
  • Physical Security: Level 3
  • Design Assurance: Level 3
  • Mitigation of Other Attacks: N/A

Approved algorithms (10)

AlgorithmCAVP certificates
AES4527
CVL1208, 1209
DRBG1487
ECDSA1102
HMAC2987
KAS122
KBKDF133
KTSvendor affirmed
RSA2464
SHS3708

Allowed algorithms

EC Diffie-Hellman (CVL Cert. #1209, key agreement; key establishment methodology provides 192 bits of encryption strength); NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength)

Tested configurations

  • N/A

Validation history

DateTypeLab
2017-09-05InitialAcumen Security
2017-10-17UpdateAcumen Security

Status timeline

As observed by this tracker's snapshots. NIST publishes no dates for list moves; observation began 2026-08-21, so earlier changes carry no date.

  • 2026-08-21: first observed by this tracker, status historical
  • Validation dates on record: 2017-09-05, 2017-10-17

Source documents