By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

How do AWS services access/authenticate/authorize to CloudHSM?

0

Are AWS services assigned IAM roles that allow them to access the CloudHSM API....and then use the CloudHSM client Crypto User account to complete their task encrypt/decrypt task? If no, how does an AWS service access CloudHSM?

If unlike, AWS KMS, lots of services do not integrate with CloudHSM, how do they use it? Or, do only a few services use CloudHSM while the ones that integrate with Cloud KMS go that route? Is anyone aware of list of services that integrate with CloudHSM? I've been researching this for two days.

Topics
Security, Identity, & ComplianceManagement & Governance
Tags
AWS CloudHSMAWS Key Management ServiceSecurity, Identity, & ComplianceAWS Management ConsoleAWS Service Catalog
Language
English
AWS-User-1591731
asked 2 years ago331 views
2 Answers
0

If you're using AWS services, integrate them with AWS Key Management Service, and then KMS integrates with CloudHSM as a custom key store.

Integrating AWS services with KMS (Access controls, IAM, etc): https://docs.aws.amazon.com/kms/latest/developerguide/control-access.html

Custom key store: https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html

AWS
Dan_H
answered 2 years ago
  • AWS-User-1591731
    2 years ago

    Thanks a lot for the quick response. Is it mandatory to use CloudHSM as a custom Key store in order to use it with most AWS services? I have been asked to research CloudHSM only. Can you use CloudHSM on its own? If so, will it work with all AWS services, and how do the services actually connect to CloudHSM?

  • Dan_H
    2 years ago

    Can you explain why you wouldn't want to use KMS, while using AWS services? That may help with designing a solution.

    You can integrate CloudHSM with many third party secret managers as well: https://docs.aws.amazon.com/cloudhsm/latest/userguide/other-integrations.html

    I am not aware of AWS services integrating directly with CloudHSM, except by one hopping via KMS.

0

Thanks Dan. I am writing a knowledge base article on CloudHSM at work and want to leave KMS out of the article if I can. I was under the impression that you could use CloudHSM on its own without going the KMS route and using custom key store. Theoretically, can you use CloudHSM without Custom Key store, and if so, how do AWS IAM and the crypto users work together to carry out cryptographic functions in your AWS account?

AWS-User-1591731
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content