How do AWS services access/authenticate/authorize to CloudHSM?

Question

Are AWS services assigned IAM roles that allow them to access the CloudHSM API....and then use the CloudHSM client Crypto User account to complete their task encrypt/decrypt task? If no, how does an AWS service access CloudHSM?

If unlike, AWS KMS, lots of services do not integrate with CloudHSM, how do they use it? Or, do only a few services use CloudHSM while the ones that integrate with Cloud KMS go that route? Is anyone aware of list of services that integrate with CloudHSM? I've been researching this for two days.

Answer

If you're using AWS services, integrate them with AWS Key Management Service, and then KMS integrates with CloudHSM as a custom key store.

Integrating AWS services with KMS (Access controls, IAM, etc): https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html

Custom key store:  https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html

Answer

Thanks Dan. I am writing a knowledge base article on CloudHSM at work and want to leave KMS out of the article if I can. I was under the impression that you could use CloudHSM on its own without going the KMS route and using custom key store. Theoretically, can you use CloudHSM without Custom Key store, and if so, how do AWS IAM and the crypto users work together to carry out cryptographic functions in your AWS account?

How do AWS services access/authenticate/authorize to CloudHSM?

관련 콘텐츠