AWS CloudHSM plugin requires following configuration settings

Field

Type 

Description

accessKeyId

string

AWS Access Key ID for authentication

secretAccessKey

string

AWS Secret Access Key for authentication

region

string

AWS region where CloudHSM cluster is located (e.g., us-east-1)

hsmClusterId

string

CloudHSM cluster ID (e.g., cluster-1234567890abcdef0)

cryptoUserName

string

CloudHSM crypto user name for PKCS#11 authentication

cryptoUserPassword

string

CloudHSM crypto user password

ssmInstanceId

string

EC2 instance ID with CloudHSM access for SSM tunneling (required for production; any value for mock mode)

hsmIpAddress

string

CloudHSM ENI IP address for SSM port forwarding. Use 127.0.0.1, localhost, or host.docker.internal for mock mode

hsmPort

int

CloudHSM PKCS#11 port (default: 2223)

localPort

int

Local port for SSM tunnel (default: 2223)

caCertificate

string

CloudHSM cluster CA certificate in PEM format (required for production; any value for mock mode)

Example Plugin Configuration

{
    "accessKeyId": "AKIA1A2B3C4D5E6F7G8H",
    "secretAccessKey": "abcdef1234567890abcdef1234567890abcdef12",
    "region": "us-east-1",
    "sessionToken": "",
    "hsmClusterId": "cluster-1234567890abcdef0",
    "cryptoUserName": "crypto-user",
    "cryptoUserPassword": "your-crypto-password",
    "ssmInstanceId": "i-0123456789abcdef0",
    "hsmIpAddress": "172.31.19.0",
    "hsmPort": 2223,
    "localPort": 2223,
    "caCertificate": "-----BEGIN CERTIFICATE-----\nMIIDTELMAkGA1UEBhMC\n...\n-----END CERTIFICATE-----\n"
}