Control access to your Amazon CloudHSM key store - Amazon Key Management Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Control access to your Amazon CloudHSM key store

You use IAM policies to control access to your Amazon CloudHSM key store and your Amazon CloudHSM cluster. You can use key policies, IAM policies, and grants to control access to the Amazon KMS keys in your Amazon CloudHSM key store. We recommend that you provide users, groups, and roles only the permissions that they require for the tasks that they are likely to perform.

To support your Amazon CloudHSM key stores, Amazon KMS needs permission to get information about your Amazon CloudHSM clusters. It also needs permission to create the network infrastructure that connects your Amazon CloudHSM key store to its Amazon CloudHSM cluster. To get these permissions, Amazon KMS creates the AWSServiceRoleForKeyManagementServiceCustomKeyStores service-linked role in your Amazon Web Services account. For more information, see Authorizing Amazon KMS to manage Amazon CloudHSM and Amazon EC2 resources.

When designing your Amazon CloudHSM key store, be sure that the principals who use and manage it have only the permissions that they require. The following list describes the minimum permissions required for Amazon CloudHSM key store managers and users.

  • Principals who create and manage your Amazon CloudHSM key store require the following permission to use the Amazon CloudHSM key store API operations.

    • cloudhsm:DescribeClusters

    • kms:CreateCustomKeyStore

    • kms:ConnectCustomKeyStore

    • kms:DeleteCustomKeyStore

    • kms:DescribeCustomKeyStores

    • kms:DisconnectCustomKeyStore

    • kms:UpdateCustomKeyStore

    • iam:CreateServiceLinkedRole

  • Principals who create and manage the Amazon CloudHSM cluster that is associated with your Amazon CloudHSM key store need permission to create and initialize an Amazon CloudHSM cluster. This includes permission to create or use an Amazon Virtual Private Cloud (VPC), create subnets, and create an Amazon EC2 instance. They might also need to create and delete HSMs, and manage backups. For lists of the required permissions, see Identity and access management for Amazon CloudHSM in the Amazon CloudHSM User Guide.

  • Principals who create and manage Amazon KMS keys in your Amazon CloudHSM key store require the same permissions as those who create and manage any KMS key in Amazon KMS. The default key policy for a KMS key in an Amazon CloudHSM key store is identical to the default key policy for KMS keys in Amazon KMS. Attribute-based access control (ABAC), which uses tags and aliases to control access to KMS keys, is also effective on KMS keys in Amazon CloudHSM key stores.

  • Principals who use the KMS keys in your Amazon CloudHSM key store for cryptographic operations need permission to perform the cryptographic operation with the KMS key, such as kms:Decrypt. You can provide these permissions in a key policy, IAM policy. But, they do not need any additional permissions to use a KMS key in an Amazon CloudHSM key store.