It is to be noted that AWS KMS manages the software for encryption while HSM manages/ provisions/encryption hardware.

• Dedicated Hardware (HSM) - Its a Literal Hardware like a physical “Key”
• You manage your own encryption (software) key entirely.
• HSM Device is tamper resistant, FIPS, 140-2, Level 3 compliance.

• Create, managed and used by the customer, can enable/disable.
• Possiblity of rotation policy.
• Possible to bring your own key. AWS Managed CMK
• Created managed & used on customer’s behalf by AWS
• Used by AWS Service (S3, EBS, Redshift) AWS Owned CMK
• Collection of CMKs owned by AWS Service & managed to be used in multiple account.
• AWS Can be use those to protect the resources in your account. Cloud HSM Keys
• Keys generated from your own CloudHSM Hardware Device.
• Cryptographic Operations peformed within CloudHSM Cluster.
• Might be a security requirement on some companies.