AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to generate and use your own encryption keys on the AWS Cloud. CloudHSM provides FIPS 140-2 Level 3 validated HSMs, giving you full control over your cryptographic keys and operations.
CloudHSM supports various cryptographic objects:
- Private Keys: RSA, EC private keys for signing and decryption
- Public Keys: RSA, EC public keys for verification and encryption
- Symmetric Keys: AES, DES3 keys for encrypt/decrypt operations
- Certificates: X.509 certificates stored in the HSM
The AWS CloudHSM Plugin is a discovery tool that connects to your CloudHSM cluster via PKCS#11 to scan and extract cryptographic object information. It uses AWS Systems Manager (SSM) Session Manager to securely tunnel to an EC2 instance in your VPC that has access to the CloudHSM cluster.
Features
- PKCS#11 Discovery: Scans cryptographic objects using standard PKCS#11 interface
- Multi-Object Type Support: Discovers private keys, public keys, symmetric keys, and X.509 certificates
- Certificate Extraction: Retrieves X.509 certificates in PEM format with SHA256 fingerprint generation
- Public Key Extraction: Retrieves public key data for RSA and EC keys in RFC 7468 compliant format
- SSM Tunneling: Secure connectivity via AWS Systems Manager Session Manager port forwarding
- Dual Authentication: AWS IAM credentials for API access plus CloudHSM crypto user credentials for PKCS#11 access
- FIPS 140-2 Level 3: All discovered objects are HSM-backed with compliance context
- Mock Mode: Built-in support for testing with mock PKCS#11 server (localhost/127.0.0.1)
- Standardized Output: Generates scan results in consistent JSON format with URN generation
- Key Origin Tracking: Distinguishes between keys created on HSM vs imported keys