diff --git a/docs/documentation/platform/kms/aws-hsm.mdx b/docs/documentation/platform/kms/aws-hsm.mdx new file mode 100644 index 000000000..4f76ff2bb --- /dev/null +++ b/docs/documentation/platform/kms/aws-hsm.mdx @@ -0,0 +1,83 @@ +--- +title: "AWS CloudHSM" +description: "Learn how to manage encryption using AWS CloudHSM" +--- + +You can configure your projects to use AWS CloudHSM for encryption, enhancing the security of your secrets. This guide will demonstrate the use of AWS CloudHSM as a custom key store for AWS KMS. + +### Prepare AWS CloudHSM Cluster + +The AWS CloudHSM cluster should meet the following criteria: + +- The cluster must be active. +- The cluster must not be associated with any other AWS KMS custom key store. +- The cluster must be configured with private subnets in at least two Availability Zones in the Region. +- The security group for the cluster must include inbound rules and outbound rules that allow TCP traffic on ports 2223-2225 +- The cluster must contain at least two active HSMs in different Availability Zones. + +For more details on setting up your cluster, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore). + +### Setup AWS KMS Custom Key Store + +To setup an AWS KMS custom key store with AWS CloudHSM, you will need the following: + +- The trust anchor certificate of your AWS CloudHSM cluster. +- A `kmsuser` user in the AWS CloudHSM cluster with the crypto-user role. + + + + Proceed to AWS KMS > AWS CloudHSM key stores and click **Create key store**. + + + Input custom key store name. ![Set key store + name](../../../images/platform/kms/aws-hsm/create-key-store-name.png) + + + Select the AWS CloudHSM cluster. You should be able to select the cluster if + it meets the required criteria. ![Set key store + cluster](../../../images/platform/kms/aws-hsm/create-key-store-cluster.png) + + + Upload your CloudHSM's cluster trust anchor certificate file. ![Set key + store cert](../../../images/platform/kms/aws-hsm/create-key-store-cert.png) + + + Input the password of the `kmsuser` crypto-user in your cluster. ![Set key + store + password](../../../images/platform/kms/aws-hsm/create-key-store-password.png) + + + Proceed with creating the AWS CloudHSM key store. + + + +For more details, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#create-keystore-console). + +### Create AWS KMS Key + + + + Proceed to AWS KMS > Customer managed keys and click Create. + + + Set Key type to **Symmetric** and Key usage to **Encrypt and decrypt**. + ![Set key options + 1](../../../images/platform/kms/aws-hsm/create-kms-key-1.png) + + + In the advanced options, for the Key material origin field, select **AWS + CloudHSM key store**. Click next. ![Set key options + 2](../../../images/platform/kms/aws-hsm/create-kms-key-2.png) + + + Select the AWS CloudHSM key store. ![Select HSM + 1](../../../images/platform/kms/aws-hsm/create-kms-select-hsm.png) + + + Proceed with creating the AWS KMS Key. + + + +### Connect Infisical to AWS KMS Key + +Now all that's left is to connect the AWS KMS key to your Infisical organization. Refer to the documentation [here](./aws-kms). diff --git a/docs/images/platform/kms/aws-hsm/create-key-store-cert.png b/docs/images/platform/kms/aws-hsm/create-key-store-cert.png new file mode 100644 index 000000000..c07c2a895 Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-key-store-cert.png differ diff --git a/docs/images/platform/kms/aws-hsm/create-key-store-cluster.png b/docs/images/platform/kms/aws-hsm/create-key-store-cluster.png new file mode 100644 index 000000000..245b11d98 Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-key-store-cluster.png differ diff --git a/docs/images/platform/kms/aws-hsm/create-key-store-name.png b/docs/images/platform/kms/aws-hsm/create-key-store-name.png new file mode 100644 index 000000000..1b47604b8 Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-key-store-name.png differ diff --git a/docs/images/platform/kms/aws-hsm/create-key-store-password.png b/docs/images/platform/kms/aws-hsm/create-key-store-password.png new file mode 100644 index 000000000..5ae84394d Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-key-store-password.png differ diff --git a/docs/images/platform/kms/aws-hsm/create-kms-key-1.png b/docs/images/platform/kms/aws-hsm/create-kms-key-1.png new file mode 100644 index 000000000..a5bb700c9 Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-kms-key-1.png differ diff --git a/docs/images/platform/kms/aws-hsm/create-kms-key-2.png b/docs/images/platform/kms/aws-hsm/create-kms-key-2.png new file mode 100644 index 000000000..78f3926d8 Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-kms-key-2.png differ diff --git a/docs/images/platform/kms/aws-hsm/create-kms-select-hsm.png b/docs/images/platform/kms/aws-hsm/create-kms-select-hsm.png new file mode 100644 index 000000000..925bf6928 Binary files /dev/null and b/docs/images/platform/kms/aws-hsm/create-kms-select-hsm.png differ diff --git a/docs/mint.json b/docs/mint.json index 5c7012745..f6bc0e5e9 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -158,7 +158,8 @@ "group": "Key Management", "pages": [ "documentation/platform/kms/overview", - "documentation/platform/kms/aws-kms" + "documentation/platform/kms/aws-kms", + "documentation/platform/kms/aws-hsm" ] }, "documentation/platform/secret-sharing"