CloudHSM cluster initialized but HSM not accepting TCP connections despite successful activation

It appears you're experiencing connectivity issues with your AWS CloudHSM cluster despite proper initialization and activation. Based on your description, there are a few key areas to investigate:

1. Security Group Configuration: While you mentioned that security groups are configured to allow ports 2223-2225, ensure that the specific cluster security group named cloudhsm-cluster-<clusterID>-sg is attached to your EC2 instance. This security group contains preconfigured rules that allow inbound and outbound communication over ports 2223-2225. Without this specific security group attached to your EC2 instance, communication with the HSM will fail.

2. Client Configuration: When you configured the AWS CloudHSM client, you provided the IP address of the HSM. If this HSM has been deleted or failed, the client won't be able to connect, resulting in errors like "LIQUIDSECURITY: Daemon socket connection error" or "LIQUIDSECURITY: Invalid Operation." Verify that the IP address in your client configuration file points to an active, reachable HSM in your cluster.

3. Cluster Activation Status: You mentioned the cluster state is "INITIALIZED" but should be "ACTIVE" after activation. When you activate a CloudHSM cluster, its state changes from initialized to active, allowing you to manage HSM users and use the HSM. Verify that the cluster activation was fully completed, which includes changing the unactivated-admin role to admin.

4. Client-HSM Communication: The error "Failed to establish connection after retries" suggests that while your network configuration might allow traffic, there could be an issue with the client's ability to establish a secure connection to the HSM.

To resolve these issues:

• Double-check that the cluster security group is attached to your EC2 instance
• Verify the IP address in your client configuration matches an active HSM
• Ensure the cluster has been fully activated (not just initialized)
• Try stopping the client, updating the configuration with the correct HSM IP address, and restarting the client

If these steps don't resolve the issue, you might need to check for any VPC configuration issues that could be blocking traffic despite being in the same subnet.
Sources
Lost connection to the AWS CloudHSM cluster - AWS CloudHSM
Configure the Client Amazon EC2 instance security groups for AWS CloudHSM - AWS CloudHSM
Activate the cluster in AWS CloudHSM - AWS CloudHSM
Review the security group for your cluster in AWS CloudHSM - AWS CloudHSM