Output Format

Certificate Discovery

{
  "result_type": "scan",
  "plugin_id": "aws-cloudhsm-plugin",
  "plugin_version": "1.1.0",
  "data": {
    "type": "cert",
    "timestamp": "2026-02-27T10:11:37Z",
    "urn": "urn:cert:sha256:1009c0242c95817ff7323482637a7127a63d91bb50c0789a74b2d812ab2fcd34",
    "url": "https://console.aws.amazon.com/cloudhsm/home?region=us-east-1#/clusters/cluster-123/certificates",
    "cert_pem": "MIIDfTCCAm...(base64 without headers)...",
    "extra": {
      "platform_type": "aws",
      "hsm_backed": true,
      "cluster_id": "cluster-123",
      "region": "us-east-1",
      "label": "my-cert",
      "cert_reference": "0x0000000000000001",
      "cert_type": "X.509",
      "token_label": "hsm1",
      "token_serial": "",
      "firmware_version": "10.23"
    }
  }
}

Private Key Discovery

{
  "result_type": "scan",
  "plugin_id": "aws-cloudhsm-plugin",
  "plugin_version": "1.1.0",
  "data": {
    "type": "privkey",
    "timestamp": "2026-02-27T10:11:37Z",
    "urn": "urn:privkey:name:my-rsa-key:0x0000000000000003",
    "url": "https://console.aws.amazon.com/cloudhsm/home?region=us-east-1#/clusters/cluster-123/keys",
    "extra": {
      "platform_type": "aws",
      "hsm_backed": true,
      "cluster_id": "cluster-123",
      "region": "us-east-1",
      "label": "my-rsa-key",
      "key_reference": "0x0000000000000003",
      "key_type": "CKK_RSA",
      "key_length": 2048,
      "extractable": false,
      "sensitive": true,
      "origin": "aws_created",
      "token_label": "hsm1",
      "token_serial": "",
      "firmware_version": "10.23",
      "usage_flags": {
        "sign": true,
        "decrypt": true,
        "unwrap": true,
        "derive": false
      }
    }
  }
}

Public Key Discovery

{
  "result_type": "scan",
  "plugin_id": "aws-cloudhsm-plugin",
  "plugin_version": "1.1.0",
  "data": {
    "type": "pubkey",
    "timestamp": "2026-02-27T10:11:37Z",
    "urn": "urn:pubkey:sha256:b05aaba4c71cb0acd32f4c24bf16ea328bafd1da265824d6ff168113cf12859d",
    "url": "https://console.aws.amazon.com/cloudhsm/home?region=us-east-1#/clusters/cluster-123/keys",
    "pubkey_pem": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...(base64 without headers)...",
    "extra": {
      "platform_type": "aws",
      "hsm_backed": true,
      "cluster_id": "cluster-123",
      "region": "us-east-1",
      "label": "my-rsa-key-pub",
      "key_reference": "0x0000000000000004",
      "key_type": "CKK_RSA",
      "extractable": false,
      "sensitive": false,
      "token_label": "hsm1",
      "token_serial": "",
      "firmware_version": "10.23",
      "usage_flags": {
        "verify": true,
        "encrypt": true,
        "wrap": true,
        "derive": false
      }
    }
  }
}

Symmetric Key Discovery

{
  "result_type": "scan",
  "plugin_id": "aws-cloudhsm-plugin",
  "plugin_version": "1.1.0",
  "data": {
    "type": "symkey",
    "timestamp": "2026-02-27T10:11:37Z",
    "urn": "urn:symkey:name:my-aes-key:0x0000000000000005",
    "url": "https://console.aws.amazon.com/cloudhsm/home?region=us-east-1#/clusters/cluster-123/keys",
    "extra": {
      "platform_type": "aws",
      "hsm_backed": true,
      "cluster_id": "cluster-123",
      "region": "us-east-1",
      "label": "my-aes-key",
      "key_reference": "0x0000000000000005",
      "key_type": "CKK_AES",
      "key_length": 256,
      "extractable": false,
      "sensitive": true,
      "origin": "aws_created",
      "token_label": "hsm1",
      "token_serial": "",
      "firmware_version": "10.23",
      "usage_flags": {
        "encrypt": true,
        "decrypt": true,
        "wrap": true,
        "unwrap": true,
        "sign": false,
        "verify": false,
        "derive": false
      }
    }
  }
}

URN Generation


  • Certificates: urn:cert:sha256:<fingerprint> - SHA256 fingerprint of DER-encoded certificate
  • Public Keys: urn:pubkey:sha256:<fingerprint> (when PEM available) or urn:pubkey:name:<label>:<reference> (fallback)
  • Private Keys: urn:privkey:name:<label>:<reference> - Name-based (no key material exported)
  • Symmetric Keys: urn:symkey:name:<label>:<reference> - Name-based (no key material exported)

Extra Fields


The extra object contains CloudHSM-specific metadata. Fields vary based on object type:


Common Fields (All Types)


Field

Type

Description

platform_type

string

Always "aws"

hsm_backed

boolean

Always true for CloudHSM objects

cluster_id

string

CloudHSM cluster ID

region

string

AWS region

label

string

Object label from PKCS#11

token_label

string

HSM token label

token_serial

string

HSM token serial number

firmware_version

string

HSM firmware version (e.g., "10.23")


Key-Specific Fields


Field

Type

Description

key_reference

string

PKCS#11 object handle (hex format)

key_type

string

PKCS#11 key type (CKK_RSA, CKK_EC, CKK_AES, CKK_DES3)

key_length

int

Key length in bits (when available)

extractable

boolean

Whether key can be exported from HSM

sensitive

boolean

Whether key is marked sensitive

origin

string

Key origin: "aws_created" (generated on HSM) or "imported"

usage_flags

object

Allowed operations: sign, verify, encrypt, decrypt, wrap, unwrap, derive


Certificate-Specific Fields


Field

Type

Description

cert_reference

string

PKCS#11 object handle (hex format)

cert_type

string

Certificate type (typically "X.509")


Note: Certificate intrinsic fields (subject, issuer, serial number, validity dates) are NOT included in extra when cert_pem is present, as they can be derived from the PEM data.