AWS CloudHSM Cluster Initialization and KMS Custom Key Store Setup

```

Overview

Create and initialize an AWS CloudHSM cluster
Create the first & Second HSM
Download and sign the cluster CSR using a self-signed customer root CA
Upload the signed certificates to initialize the cluster
Configure an EC2 instance to communicate with the cluster
Install and configure CloudHSM CLI
Activate the cluster
Create users, including a dedicated kmsuser
Create an AWS KMS custom key store backed by the CloudHSM cluster

Prerequisites

Before you begin: - You have access to the AWS CloudHSM console - You have an EC2 instance in the same VPC as the CloudHSM cluster - You can transfer files between your local machine and the EC2 instance, for example using WinSCP - OpenSSL is available on the EC2 instance or agent machine used to sign the cluster CSR - The EC2 instance can communicate with the cluster security group

Important: To create an AWS KMS custom key store, the CloudHSM cluster must have at least two active HSMs in different Availability Zones.

Step 1: Create the CloudHSM cluster

Open the AWS CloudHSM Console
Choose Create cluster
Select the required VPC and subnet/AZ
Create the cluster

Step 2: Click Initialize

In the CloudHSM console, open the new cluster
Choose Initialize

Step 3: Create the first HSM in Availability Zone 1

In the cluster, choose Create HSM
Select Availability Zone 1
Wait until the HSM creation completes

Step 4: Download the cluster CSR

In the CloudHSM console, download the cluster CSR
Save the file locally Example filename: cluster-4o5t4yoskx7_ClusterCsr.csr

Step 5: Transfer the CSR to the EC2 agent via WinSCP

Open WinSCP
Connect to the EC2 agent
Upload the CSR file to the EC2 instance

Step 6: Create a self-signed customer root CA and sign the cluster CSR

Generate the customer root CA private key

openssl genrsa -out customerRootCA.key 2048

Generate the self-signed customer root CA certificate

openssl req -x509 -new -nodes \
  -key customerRootCA.key \
  -sha256 -days 3650 \
  -out customerRootCA.crt \
  -subj "/CN=CustomerRootCA"

Sign the cluster CSR with the customer root CA

openssl x509 -req \
  -in cluster-4o5t4yoskx7_ClusterCsr.csr \
  -CA customerRootCA.crt \
  -CAkey customerRootCA.key \
  -CAcreateserial \
  -out clusterCertificate.crt \
  -days 3650 \
  -sha256

Step 7: Move the signed certificates back to your machine

Copy these files from the EC2 instance to your local machine: - clusterCertificate.crt - customerRootCA.crt

Step 8: Upload the certificates in the AWS CloudHSM console

Upload: - Cluster certificate → clusterCertificate.crt - Issuing certificate → customerRootCA.crt

Step 8.1: Attach the CloudHSM security group to the EC2 instance

Open the EC2 Console
Select the EC2 instance
Choose Actions → Security → Change security groups
Add the CloudHSM cluster security group
Save

Step 8.2: Install CloudHSM CLI on the EC2 instance

sudo apt install ./cloudhsm-cli_latest_u22.04_amd64.deb

Step 8.3: Copy the issuing certificate to the EC2 instance

sudo mkdir -p /opt/cloudhsm/etc
sudo cp customerRootCA.crt /opt/cloudhsm/etc/customerCA.crt

Step 9: Install and configure CloudHSM CLI

sudo /opt/cloudhsm/bin/configure-cli --hsm-ca-cert /opt/cloudhsm/etc/customerCA.crt
sudo /opt/cloudhsm/bin/configure-cli add-cluster --cluster-id <your-cluster-id>

Or:

sudo /opt/cloudhsm/bin/configure-cli -a <hsm-eni-ip>

Step 10: Activate the cluster

/opt/cloudhsm/bin/cloudhsm-cli interactive
user list
cluster activate

Step 11: Log in as admin

login --username admin --role admin

Step 12: Create the KMS crypto user

login --username admin --role admin
user create --username kmsuser --role crypto-user

Step 13: Add the second HSM in a different Availability Zone

Create a second HSM in a different Availability Zone
Wait until both HSMs are active

Step 14: Create the AWS KMS custom key store

In AWS KMS: 1. Open Custom key stores 2. Choose AWS CloudHSM key stores 3. Choose Create key store 4. Enter: - custom key store name - CloudHSM cluster ID - password for kmsuser - trust anchor certificate

Validation checklist

[ ] Cluster created
[ ] Cluster initialized
[ ] First HSM created and active
[ ] Second HSM active in another AZ
[ ] Cluster CSR downloaded
[ ] Customer root CA created
[ ] Cluster CSR signed
[ ] clusterCertificate.crt uploaded
[ ] customerRootCA.crt uploaded
[ ] EC2 instance attached to CloudHSM security group
[ ] CloudHSM CLI installed
[ ] CLI configured
[ ] Cluster activated
[ ] Admin login successful
[ ] kmsuser created as crypto-user
[ ] AWS KMS custom key store created
Delete the KMS custom key store first If you created an AWS KMS custom key store backed by CloudHSM:
Open AWS KMS → Custom key stores
Select the custom key store
Disconnect it
Then Delete it AWS requires a custom key store to be disconnected before deletion.
Schedule deletion of KMS keys in that custom key store If you created any KMS keys in that custom key store:
Open AWS KMS → Customer managed keys
Find keys associated with that custom key store
For each key, choose Key actions → Schedule key deletion KMS keys cannot be deleted immediately; they must be scheduled for deletion with a waiting period.
Delete CloudHSM HSMs In AWS CloudHSM:
Open your cluster
Go to HSMs
Delete each HSM one by one AWS does not let you delete the cluster until all HSMs are removed.
Delete the CloudHSM cluster After all HSMs are deleted:
Open AWS CloudHSM
Select the cluster
Choose Delete cluster A cluster can be deleted only after all HSMs are gone.
Delete CloudHSM backups
Deleting the cluster does not automatically remove all backups.
In AWS CloudHSM, open Backups
Delete the backups you no longer want AWS notes that backups may need separate deletion, and the final backup is not automatically removed in all cases.
Remove the EC2-side CloudHSM client setup
On the EC2 instance you used for admin/client access: ```