fwiw a CloudHSM is a dedicated piece of hardware that is otherwise fairly expensive.
I mention it because its trivial to provision in AWS accounts.
In sandbox accounts we provision for developers, we use AWS Orgs and service control policies to ensure IAM users with full privs can't provision an HSM.