Skip to main content

Your Data, Your Keys, Your Control: Bring your own keys to AWS CloudHSM - Part 3

· 4 min read

Introduction​

Please refer HSM Part 1 & HSM Part 2 for additional details on HSM setup.

AWS Key Management Service (KMS) provides a secure, centralized platform for managing cryptographic keys. Multi-Region keys in AWS KMS allow you to use the same keys across multiple AWS Regions, making it easier to manage encrypted data and ensuring business continuity. In this guide, we'll explore how to set up and use Multi-Region

BYOK (Bring Your Own Key) in AWS KMS.



Step 1: Setting Up Your Environment

Before you start, ensure you have an AWS account with the necessary permissions, AWS CLI installed, and familiarity with AWS regions and KMS concepts.

Creating an Empty Directory on EC2 Instance:

Start by creating a new directory on your EC2 instance where you'll manage your keys:

mkdir /opt/vb-hsm/hsm-21
cd /opt/vb-hsm/hsm-21

Step 2: Creating a Multi-Region KMS Key


Multi-Region KMS Multi-Region KMS


Generate a new KMS key with no key material associated, indicating it's external and multi-region:

aws kms create-key --origin EXTERNAL --region us-east-1 --multi-region

You'll receive an output similar to this:

{
    "KeyMetadata": {
        "AWSAccountId": "<AccountID>",
        "KeyId": "mrk-d58582b2563a40ef893d9181052130db",
        "Arn": "arn:aws:kms:us-east-1:<AccountID>:key/mrk-d58582b2563a40ef893d9181052130db",
        ...
        "MultiRegion": true,
        ...
    }
}

Make sure to note down the KeyId as it will be used later.

Step 3: Preparing for Key Import

Create an alias for easier reference to your key:

aws kms create-alias --alias-name alias/byok-mrk --target-key-id mrk-d58582b2563a40ef893d9181052130db

Retrieve the parameters needed for importing your key:

aws kms get-parameters-for-import --key-id mrk-d58582b2563a40ef893d9181052130db --wrapping-algorithm RSAES_OAEP_SHA_256 --wrapping-key-spec RSA_2048 --region us-east-1 > ./WrappingParameters.json

Extract the import token and create a public key:

jq -r '.ImportToken' ./WrappingParameters.json > ./ImportToken.b64
echo -e "-----BEGIN PUBLIC KEY-----\n$(jq -r '.PublicKey' ./WrappingParameters.json)\n-----END PUBLIC KEY-----" > ./PublicKey.pem
openssl enc -d -base64 -A -in ./ImportToken.b64 -out ./ImportToken.bin

Step 4: Importing Key Material

Initialize your Crypto user and import settings:

export CLOUDHSM_ROLE=crypto-user
export CLOUDHSM_PIN=cu_user1:acord12345
/opt/cloudhsm/bin/cloudhsm-cli key import pem --path ./PublicKey.pem --label wrapping-key-example-21 --key-type-class rsa-public --attributes wrap=true

Step 5: Replicating Key to Another Region

Understand the mechanics of cross-Region replication, crucial for maintaining data consistency across geographical locations. Use AWS KMS's built-in replication features to copy key material securely between regions, adhering strictly to AWS security protocols.

Read about Key Management
Ready to take your cloud infrastructure to the next level? Please reach out to us Contact Us


Conclusion​

Using AWS KMS Multi-Region keys with BYOK configurations adds a layer of flexibility and security to your cloud infrastructure, enabling seamless data encryption and decryption across different AWS Regions. By carefully following these steps and maintaining rigorous security standards, you can ensure the safety of your key material and uphold compliance across your organization.

🔚 Call to Action​


Choosing the right platform depends on your organizations needs. For more insights, subscribe to our newsletter for insights on cloud computing, tips, and the latest trends in technology. or follow our video series on cloud comparisons.


Interested in having your organization setup on cloud? If yes, please contact us and we'll be more than glad to help you embark on cloud journey.


💬 Comment below:
How is your experience with Mac on EC2? What do you want us to review next?