AWS CloudHSM plugin requires following IAM Permissions

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudhsmv2:DescribeClusters",
                "ssm:StartSession",
                "ssm:TerminateSession",
                "ssmmessages:CreateControlChannel",
                "ssmmessages:CreateDataChannel",
                "ssmmessages:OpenControlChannel",
                "ssmmessages:OpenDataChannel"
            ],
            "Resource": "*"
        }
    ]
}

Permission Breakdown:

• cloudhsmv2:DescribeClusters: Required to get cluster metadata and verify HSM IP addresses
• ssm:StartSession/TerminateSession: Required for SSM tunnel management to EC2 instance
• ssmmessages:*: Required for SSM Session Manager communication channels

CloudHSM Crypto User Requirements

The crypto user must have permissions to:

• List token objects (CKA_TOKEN objects)
• Read object attributes (labels, key types, certificates, public key material)
• Access PKCS#11 session operations

Note: The plugin uses the PIN format username:password as required by AWS CloudHSM PKCS#11 library.