AWS CloudHSM is correct because it provides dedicated, single-tenant hardware security modules that let you generate and store encryption keys inside customer-controlled, tamper-resistant hardware to meet strict compliance requirements.

AWS CloudHSM gives you HSM appliances that are dedicated to your account and under your management, and the devices are FIPS validated and designed to resist tampering so keys are created and protected inside hardware you control. This approach aligns with policies that mandate customer-controlled, single-tenant key generation and is suitable for large volumes of encrypted research data.

AWS KMS is not ideal for this requirement because KMS uses AWS managed, multi-tenant HSMs by default and does not by itself provide customer-dedicated hardware. You can integrate KMS with a custom key store backed by CloudHSM to get dedicated HSMs but KMS alone does not satisfy a strict single-tenant, tamper-resistant hardware mandate.

AWS Certificate Manager is focused on provisioning and managing TLS certificates and it does not generate or store general data encryption keys in dedicated HSM hardware so it does not meet the compliance requirement.

AWS Nitro Enclaves provides isolated compute environments for secure processing and it can help protect secrets in memory while processing, but it is not an HSM service and it does not offer tamper-resistant, single-tenant hardware for key generation and storage so it cannot fulfill the stated requirement.

Full AWS Practitioner Certification Question