By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Migration from AWS KSM to a combined solution with CloudHSM

0

Hey, I'm working on a solution that I want to propose to my customer for a move to cloud project. They want to start with a small of services and cost on AWS. So I have to start to land the applications in AWS with limited services. For encryption purpose, I'll start with AWS KMS only at the beginning with a dedicated CMK for each application and each related AWS service. But the customer want to possess the key material for the new step of the project. That's why I suggest to bring CloudHSM with AWS KMS. However, I don't know what can be the impact of this new encryption services combination, on the existing keys, backed up keys, ...?

Do you have any suggestion?

Regards Fatih

  • kumo-hiyori
    a year ago

    What are the risks that customer wants to protect against by "possessing the key material"? You are always in control of the key that you create in KMS through the key policy and IAM policy. You have full control over the lifecycle of CMKs. The common pitfall that we see a lot of customers fall into is when they fail to properly evaluate the cost of key management vs. threats they face. Customer often delegate the decision to their compliance/governance team who may not fully understand about AWS and KMS to make informed decision.

  • kumo-hiyori
    a year ago

    Also, one point to note is that migrating between KMS and CloudHSM and vice versa later on is difficult. You would need to recreate the new key, switch other AWS service that was dependent on old key, and re-encrypt the data. You will incur additional charge from respective AWS services to do the operation.

  • millerkt
    10 months ago

    You should take a look at AWS KMS External Key Store.

    https://docs.aws.amazon.com/kms/latest/developerguide/keystore-external.html

Topics
Security, Identity, & Compliance
Tags
AWS CloudHSMAWS Key Management ServiceSecurity, Identity, & ComplianceEncryption
Language
English
Fatih
asked a year ago333 views
1 Answer
1

Cloud HSM is pretty expensive. If they want to control the keys they can import their key using BYOK. https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html. Not saying don't use CMK but if the only reason for using HSM is to own the key then that can also be done with KMS

Evan
answered a year ago
  • Fatih
    a year ago

    Thanks for feedback. The purpose of using HSM is regulatory compliance and to not manage (import) CMK and let it to HSM.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content