AWS cloudhsm documentation change

Service: cloudhsm · 2025-05-03 · Documentation low

File: cloudhsm/latest/userguide/cloudhsm_cli-key-generate-file.md

Summary

Added documentation for generating KSP key references on Windows platforms, including syntax, examples, and file location details

Security assessment

The change documents secure key management practices for Windows KSP integration, emphasizing that private keys are not exported from HSM. While security-related, there is no evidence of addressing a specific vulnerability.

Diff

diff --git a/cloudhsm/latest/userguide/cloudhsm_cli-key-generate-file.md b/cloudhsm/latest/userguide/cloudhsm_cli-key-generate-file.md
index 6126e6a4c..8b9fdcc69 100644
--- a//cloudhsm/latest/userguide/cloudhsm_cli-key-generate-file.md
+++ b//cloudhsm/latest/userguide/cloudhsm_cli-key-generate-file.md
@@ -5 +5 @@
-User typeRequirementsSyntaxExampleArgumentsRelated topics
+User typeRequirementsSyntaxExampleArgumentsGenerating KSP key references (Windows)Related topics
@@ -97,0 +98,75 @@ Required: Yes
+## Generating KSP key references (Windows)
+
+### Prerequisites
+
+  * You can generate KSP key references only on Windows platforms.
+
+  * You must sign in as a crypto user (CU).
+
+
+
+
+### File location
+
+By default, AWS CloudHSM stores generated files in: `C:\Users\Default\AppData\Roaming\Microsoft\Crypto\CaviumKSP\GlobalPartition`
+
+To specify a different location, use the `--path` parameter.
+
+### Syntax
+    
+    
+    aws-cloudhsm > help key generate-file --encoding ksp-key-reference 
+    Generate a key file from a key in the HSM cluster. This command does not export any private key data from the HSM
+    
+    Usage: key generate-file --encoding <ENCODING> --path <PATH> --filter [<FILTER>...]
+    
+    Options:
+          --encoding <ENCODING>
+            Encoding format for the key file
+    
+            Possible values:
+            - reference-pem:     PEM formatted key reference (supports private keys)
+            - pem:               PEM format (supports public keys)
+            - ksp-key-reference: KSP key reference format
+    
+          --cluster-id <CLUSTER_ID>
+            Unique Id to choose which of the clusters in the config file to run the operation against. If not provided with multiple clusters configured, will error
+    
+          --path <PATH>
+            Directory path where the key file will be written
+    
+          --filter [<FILTER>...]
+            Key reference (e.g. key-reference=0xabc) or space separated list of key attributes in the form of attr.KEY_ATTRIBUTE_NAME=KEY_ATTRIBUTE_VALUE to select a matching key for file generation
+    
+          --all
+            Generate ksp key reference for all available key pairs in HSM
+    
+      -h, --help
+            Print help (see a summary with '-h')
+
+### Example – Generate a KSP key reference using an attribute filter of a private key
+
+The following example generates a KSP key reference for a private key with a specific label.
+    
+    
+    aws-cloudhsm > key generate-file --encoding ksp-key-reference --path  --filter attr.label="ec-test-private-key"
+    {
+      "error_code": 0,
+      "data": {
+        "message": "Successfully generated key file"
+      }
+    }
+
+### Example – Generate KSP key references for all key pairs
+
+The following example generates KSP key references for all key pairs in your cluster.
+    
+    
+    aws-cloudhsm > key generate-file --encoding ksp-key-reference --all
+    {
+      "error_code": 0,
+      "data": {
+        "message": "Successfully generated key file"
+      }
+    }
+