AWS KMS users that want to use a custom key store will need to set up an AWS CloudHSM cluster, add HSMs, manage HSMs users and potentially restore HSMs from backup. These are security sensitive tasks and you can verify that you have the appropriate resources and organizational controls in place.