Key management service
A cloud service that creates, stores and uses encryption keys, so the customer does not have to run their own key hardware.
AWS KMS launched in 2014, with Google Cloud KMS and Azure Key Vault as its counterparts. Keys as a rule never leave the service in plaintext, and use can be logged. It is simpler than running your own HSM, but you trust the provider's interface and hope the bill for API calls does not grow too quickly.
The service usually sits under envelope encryption, so applications only see data keys. It is also a weak point: when calls to KMS fail, decryption fails for everything that depends on it. That is an operations problem as much as a security one.