Skip to content

How to integrate AWS CloudHSM with a serverless architecture using CloudHSM Client SDK 5?

1

I’m working on a serverless project and would like to integrate AWS CloudHSM using the AWS CloudHSM Client SDK 5. According to the official documentation, this should be possible, but the page doesn’t include any practical examples or implementation guidance.

Most examples I’ve found involve provisioning an EC2 instance to run the client daemon, which makes sense in a traditional setup. However, it’s unclear how to achieve this in a serverless architecture (e.g., with AWS Lambda or containerized tasks in AWS Fargate). I would prefer a Lambda example, though.

I’m specifically looking to understand:

What are the architectural considerations or limitations when using CloudHSM with serverless compute?

How and where should the CloudHSM client daemon run in a serverless environment?

Is there a supported way to connect from Lambda or Fargate to CloudHSM using the SDK 5?

Any insights, examples, or reference architectures would be helpful.

2 Answers
6
Accepted Answer

Check this out, by using Fargate Integration:

  • Dockerize your app with the PKCS#11 5.0 library and CloudHSM config
  • Store the image in Amazon ECR
  • Inject secrets via AWS Secrets Manager
  • Run the container in Amazon ECS with Fargate, in the same VPC as CloudHSM

https://aws.amazon.com/blogs/security/integrate-cloudhsm-pkcs-11-library-5-0-with-serverless-workloads/

EXPERT

answered a year ago

0

hi,

AWS has published an official blog post showing how to run AWS CloudHSM workloads on AWS Lambda by packaging the CloudHSM client and its requirements in a Lambda layer, and then running the CloudHSM client in a child process from within the Lambda function code:

https://aws.amazon.com/blogs/security/how-to-run-aws-cloudhsm-workloads-on-aws-lambda/

Best

answered a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.