An online retail company uses Amazon Redshift to store historical sales transactions. The company is required to encrypt data at rest in the clusters to comply with the Payment Card Industry Data…

AWS CloudHSM Classic is deprecated, and the requirement specifically mandates an *on-premises* HSM, not a cloud-based one.

For Amazon Redshift to utilize an on-premises HSM for encryption key management, a secure network connection like a VPN or AWS Direct Connect must be established between the Redshift cluster's Virtual Private Cloud (VPC) and the on-premises network where the HSM resides. This foundational step enables the required communication between Redshift and the HSM.

Creating an HSM connection and client certificate are subsequent configuration steps within Redshift, but they cannot be performed or utilized without first establishing the underlying network connectivity to the *on-premises* HSM.

Creating a replica in AWS CloudHSM is using a cloud-based HSM, which contradicts the requirement to manage encryption keys using an *on-premises* hardware security module.