Is there a basis for such an assumption?<p>For an organization requiring the highest available security, the ideal solution would be a privately operated hardware security module kept off the DMZ. However, that, as well as the idea of self hosting (and maintaining) the entire dev, test, deploy, and prod stack suggested by another commenter, isn&#x27;t always within reach of a small, agile team looking to focus on their core competencies.<p>One could argue that it&#x27;s possible for Amazon to have falsified the description of KMS as an HSM, or the certifications[0] they were granted for it, but I&#x27;d retort that an organization in a position to seriously question those claims shouldn&#x27;t be using a remote solution anyway.<p>So, making the more rational assumption that such claims by Amazon can be trusted, their offering is quite secure: the HSM does not allow the export of any key, and exposes only the ability to load encrypted data into the device and have it produce the decrypted result over a secure channel, and vice versa.<p>[0]: <a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;kms&#x2F;details&#x2F;#compliance" rel="nofollow">https:&#x2F;&#x2F;aws.amazon.com&#x2F;kms&#x2F;details&#x2F;#compliance</a>