Day 6: AWS CloudHSM Architecture

Phase 5 · August 31, 2026

Agenda (2–3 hours)

• Read (60 min): AWS CloudHSM User Guide — clusters, initialization, HSM users
• Study (60 min): CloudHSM vs. SoftHSM2 vs. ACM PCA key management
• Write (30 min): CloudHSM fit analysis for your provisioning service

AWS CloudHSM: What It Is

AWS CloudHSM is a managed HSM service that:

• Provisions FIPS 140-2 Level 3 HSM hardware inside your VPC
• Gives you exclusive single-tenant access to the HSM
• Presents a PKCS#11 interface (plus JCE and OpenSSL) via a client library
• AWS manages the hardware; you manage the keys and HSM users
• AWS cannot access your key material (unlike KMS)

Contrast with KMS:

CloudHSM Cluster Model

CloudHSM uses a cluster — multiple HSMs across Availability Zones:

Your VPC:
├── us-east-1a: CloudHSM instance (primary)
├── us-east-1b: CloudHSM instance (replica)
└── us-east-1c: CloudHSM instance (replica)

CloudHSM Client (runs on your EC2/ECS)
└── connects to any HSM in the cluster
    └── keys are automatically synchronized across HSMs

Benefits:

• HA: if one HSM fails, others serve requests
• Throughput: multiple HSMs handle concurrent signing requests
• Geographic redundancy: cross-AZ placement

For your provisioning service: cluster across 3 AZs = can tolerate 2 HSM failures.

CloudHSM User Types

CloudHSM has three user types (not the same as PKCS#11 CKU_SO/CKU_USER):

Your provisioning service runs as a Crypto User (CU).
Key ceremony and HSM initialization requires a Crypto Officer (CO).

Connecting from EC2: The Client Library

CloudHSM provides a client library that implements PKCS#11:

# Install CloudHSM client
wget https://s3.amazonaws.com/cloudhsmv2-software/CloudHsmClient/...
sudo rpm -ivh cloudhsm-client-*.rpm

# Configure with your cluster's IP
sudo /opt/cloudhsm/bin/configure-client -a <cluster-ip>

# Start the client daemon
sudo systemctl start cloudhsm-client

// Your Rust code uses the SAME cryptoki API as with SoftHSM2
// Just change the library path:
let pkcs11 = Pkcs11::new("/opt/cloudhsm/lib/libcloudhsm_pkcs11.so")?;
//                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
//                        CloudHSM client library instead of SoftHSM2

This is why SoftHSM2 is the right dev environment — the code is identical.

CloudHSM for CA Key Storage

To use CloudHSM as the CA key store for your provisioning service:

Option A: CloudHSM-backed SPIRE CA
  SPIRE server → CloudHSM via PKCS#11 plugin
  (SPIRE KeyManager plugin: "aws_cloudhsm")

Option B: CloudHSM-backed ACM PCA
  ACM PCA with CloudHSM backing
  (Currently: ACM PCA uses AWS-managed HSMs, not customer CloudHSM)
  (CloudHSM is used for self-managed CAs outside ACM PCA)

Option C: EJBCA or custom CA on EC2
  Your CA software → CloudHSM via PKCS#11 for signing
  Separate from ACM PCA

Key insight: If you use ACM PCA, you don't manage the HSM at all.
CloudHSM is only relevant if you're running your own CA software.

CloudHSM Operational Considerations

For your provisioning service: if signing volume is low (< 100 certs/day),
CloudHSM cost is hard to justify. ACM PCA is more appropriate.

CloudHSM vs. ACM PCA: Decision Matrix

For Amazon Leo Secure Comms: if compliance requires you to hold the root key,
use CloudHSM. If managed CA is acceptable, use ACM PCA.

Challenge Assignment

Write a CloudHSM Fit Analysis for your provisioning service
(add to acm-pca-design.md as an appendix or §7):

1. When would you choose CloudHSM over ACM PCA?
   (What regulatory/compliance requirement would make CloudHSM necessary?)

2. What is the minimum HA CloudHSM configuration for your provisioning service?
   (How many HSMs, in which AZs, with what backup procedure?)

3. What is the Crypto User (CU) access pattern?
   (Which process/service needs CU credentials? How are they stored?)

4. If the CloudHSM cluster is unavailable for 30 minutes:
   (Can new certs be issued? Do existing certs still work? What fails?)

These questions prime Day 15 (failure mode analysis) where you'll answer them rigorously.

Resources

• CloudHSM User Guide: docs.aws.amazon.com/cloudhsm/latest/userguide
• CloudHSM + PKCS#11: docs.aws.amazon.com/cloudhsm/latest/userguide/pkcs11-library.html
• CloudHSM pricing: aws.amazon.com/cloudhsm/pricing
• CloudHSM vs. KMS comparison: docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html
• SPIRE KeyManager CloudHSM: github.com/spiffe/spire/tree/main/doc/plugin_server_keymanager_aws_kms.md