From cf330777ed19ee29c6621fc7ca6a356eaa8d6f30 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 31 Jul 2024 21:36:52 -0400 Subject: [PATCH] kms and hsm doc updates --- docs/documentation/platform/kms/aws-hsm.mdx | 57 ++++++++++----------- docs/documentation/platform/kms/aws-kms.mdx | 4 +- 2 files changed, 30 insertions(+), 31 deletions(-) diff --git a/docs/documentation/platform/kms/aws-hsm.mdx b/docs/documentation/platform/kms/aws-hsm.mdx index 4f76ff2bb..e7bd03fd1 100644 --- a/docs/documentation/platform/kms/aws-hsm.mdx +++ b/docs/documentation/platform/kms/aws-hsm.mdx @@ -3,48 +3,47 @@ title: "AWS CloudHSM" description: "Learn how to manage encryption using AWS CloudHSM" --- -You can configure your projects to use AWS CloudHSM for encryption, enhancing the security of your secrets. This guide will demonstrate the use of AWS CloudHSM as a custom key store for AWS KMS. +This guide provides instructions on securing Infisical project secrets using AWS CloudHSM. +Integration with AWS CloudHSM is achieved by configuring it as a custom key store for AWS KMS. +Follow the steps below to set up AWS KMS with AWS CloudHSM as the custom key store. -### Prepare AWS CloudHSM Cluster +## Prepare AWS CloudHSM Cluster -The AWS CloudHSM cluster should meet the following criteria: +Before you get started, you'll need to configure a AWS CloudHSM cluster which meets the following criteria: - The cluster must be active. - The cluster must not be associated with any other AWS KMS custom key store. - The cluster must be configured with private subnets in at least two Availability Zones in the Region. -- The security group for the cluster must include inbound rules and outbound rules that allow TCP traffic on ports 2223-2225 +- The security group for the cluster must include inbound and outbound rules that allow TCP traffic on ports 2223-2225. - The cluster must contain at least two active HSMs in different Availability Zones. For more details on setting up your cluster, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore). -### Setup AWS KMS Custom Key Store +## Set Up AWS KMS Custom Key Store -To setup an AWS KMS custom key store with AWS CloudHSM, you will need the following: +To set up an AWS KMS custom key store with AWS CloudHSM, you will need the following: - The trust anchor certificate of your AWS CloudHSM cluster. - A `kmsuser` user in the AWS CloudHSM cluster with the crypto-user role. - Proceed to AWS KMS > AWS CloudHSM key stores and click **Create key store**. + In the AWS console, head over to `AWS KMS` > `AWS CloudHSM key stores` and click **Create key store**. - Input custom key store name. ![Set key store - name](../../../images/platform/kms/aws-hsm/create-key-store-name.png) + Input the custom key store name. ![Set key store name](../../../images/platform/kms/aws-hsm/create-key-store-name.png) - Select the AWS CloudHSM cluster. You should be able to select the cluster if - it meets the required criteria. ![Set key store - cluster](../../../images/platform/kms/aws-hsm/create-key-store-cluster.png) + Select the AWS CloudHSM cluster. You should be able to select the cluster if it meets the required criteria mentioned above. + ![Set key store cluster](../../../images/platform/kms/aws-hsm/create-key-store-cluster.png) - Upload your CloudHSM's cluster trust anchor certificate file. ![Set key - store cert](../../../images/platform/kms/aws-hsm/create-key-store-cert.png) + Upload your CloudHSM's cluster trust anchor certificate file. + ![Set key store cert](../../../images/platform/kms/aws-hsm/create-key-store-cert.png) - Input the password of the `kmsuser` crypto-user in your cluster. ![Set key - store - password](../../../images/platform/kms/aws-hsm/create-key-store-password.png) + Input the password of the `kmsuser` crypto-user in your cluster. + ![Set key store password](../../../images/platform/kms/aws-hsm/create-key-store-password.png) Proceed with creating the AWS CloudHSM key store. @@ -53,31 +52,31 @@ To setup an AWS KMS custom key store with AWS CloudHSM, you will need the follow For more details, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#create-keystore-console). -### Create AWS KMS Key +## Create AWS KMS Key +Next, you'll need to create a AWS KMS key where you will set the key store you created previously. - Proceed to AWS KMS > Customer managed keys and click Create. + In your AWS console, proceed to `AWS KMS` > `Customer managed keys` and click **Create**. - Set Key type to **Symmetric** and Key usage to **Encrypt and decrypt**. - ![Set key options - 1](../../../images/platform/kms/aws-hsm/create-kms-key-1.png) + Set Key type to `Symmetric` and Key usage to `Encrypt and decrypt`. + ![Set key options 1](../../../images/platform/kms/aws-hsm/create-kms-key-1.png) - In the advanced options, for the Key material origin field, select **AWS - CloudHSM key store**. Click next. ![Set key options - 2](../../../images/platform/kms/aws-hsm/create-kms-key-2.png) + In the advanced options, for the Key material origin field, select `AWS CloudHSM key store`. Then, click next. + ![Set key options 2](../../../images/platform/kms/aws-hsm/create-kms-key-2.png) - Select the AWS CloudHSM key store. ![Select HSM - 1](../../../images/platform/kms/aws-hsm/create-kms-select-hsm.png) + Select the AWS CloudHSM key store you created earlier. + ![Select HSM 1](../../../images/platform/kms/aws-hsm/create-kms-select-hsm.png) Proceed with creating the AWS KMS Key. -### Connect Infisical to AWS KMS Key +## Connect Infisical to AWS KMS Key -Now all that's left is to connect the AWS KMS key to your Infisical organization. Refer to the documentation [here](./aws-kms). +You should now have an AWS KMS that has a custom key store set to AWS CloudHSM. +To secure project resources, you will need to add this AWS KMS to your Infisical organization. To learn how, refer to the documentation [here](./aws-kms). \ No newline at end of file diff --git a/docs/documentation/platform/kms/aws-kms.mdx b/docs/documentation/platform/kms/aws-kms.mdx index 91fea5bb7..14769f301 100644 --- a/docs/documentation/platform/kms/aws-kms.mdx +++ b/docs/documentation/platform/kms/aws-kms.mdx @@ -4,8 +4,8 @@ description: "Learn how to manage encryption using AWS KMS" --- To enhance the security of your Infisical projects, you can now encrypt your secrets using an external Key Management Service (KMS). -When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS, providing you with complete control. -This guide will walk you through the steps needed to configure AWS KMS. +When external KMS is configured for your project, all encryption and decryption operations will be handled by the chosen KMS. +This guide will walk you through the steps needed to configure external KMS support with AWS KMS. ## Prerequisites