AWS KMS does not use HSMs. Amazon says it runs on HSAs (&quot;hardened security appliance&quot;), but they don&#x27;t provide a lot of info on what that means. I would presume that the only thing keeping a limited number of Amazon employees from accessing your keys is policy.<p>I agree that using AWS KMS is the same architecture as using some other KMS that you run yourself, you just garner the benefit of their software and operational capacity and you buy service; this is the same as any other PaaS service at Amazon or some other vendor.<p>What&#x27;s the value of Cryptex, though? Why not just store KMS-wrapped secrets in your config file and have Amazon unwrap them? Then you wouldn&#x27;t be dependent on any local crypto implementation and you could use other KMS features, such as AEAD.