For its latest trick Amazon Web Services has launched CloudHSM so users - pointedly the enterprise - can up their data security and meet compliance requirements by using dedicated, tamper-resistant Hardware Security Module (HSM) appliances within the AWS cloud.

The widgetry actually comes from SafeNet.

Amazon says the CloudHSM service lets customers securely generate, store and manage the cryptographic keys used for data encryption so they're only accessible by the customer.

It recognizes that some applications and data are subject to rigorous contractual or regulatory mandates for managing cryptographic keys but up till now organizations' only options were to maintain data in on-premises data centers or deploy local HSMs to protect encrypted data in the cloud.

"Unfortunately those options either prevented customers from migrating their most sensitive data to the cloud or significantly slowed application performance."

The way CloudHSM works customers retain full ownership, control and access to keys and sensitive data while Amazon manages the HSM appliances in close proximity to their applications and data for maximum performance, i.e., cutting down on latency.

CloudHSM can support use cases and applications like database encryption, Digital Rights Management (DRM) and Public Key Infrastructure (PKI) including authentication and authorization, document signing and transaction processing.

The appliances are provisioned inside Amazon's Virtual Private Cloud (VPC) with an IP address the user specifies.

The widgetry is supposed to meet international Common Criteria EAL4+ and US government NIST FIPS 140-2 standards for cryptographic modules.

It'll cost at least $5,000 upfront and $1.88 an hour or about $1,373 a month.

It can take a few weeks to provision more than two appliances.

See http://aws.typepad.com/aws/2013/03/aws-cloud-hsm-secure-key-storage-and-cryptographic-operations.html and http://aws.amazon.com/cloudhsm/.