AWS cloudhsm documentation change
Summary
Added new known issue about increased find key latency on hsm2m.medium instances
Security assessment
Documents performance-related HSM operational characteristics (find key latency) and workarounds. While HSMs are security components, this change describes a performance limitation rather than a vulnerability or security feature.
Diff
diff --git a/cloudhsm/latest/userguide/ki-hsm2m-medium.md b/cloudhsm/latest/userguide/ki-hsm2m-medium.md index eadc4b5f2..7c4b9454a 100644 --- a//cloudhsm/latest/userguide/ki-hsm2m-medium.md +++ b//cloudhsm/latest/userguide/ki-hsm2m-medium.md @@ -5 +5 @@ -Issue: Increased login latency on hsm2m.mediumIssue: A CO using trying to set the trusted attribute of a key will fail with Client SDK 5.12.0 and earlierIssue: ECDSA verify will fail with Client SDK 5.12.0 and earlier for clusters in FIPS modeIssue: Only the PEM-formatted certificates can be registered as mtls trust anchors with CloudHSM CLIIssue: Customer applications will stop processing all requests when using mTLS with a passphrase protected client private key.Issue: User replicate fails when using the CloudHSM CLIIssue: Operations can fail during backup creationIssue: Client SDK 5.8 and above do not perform automatic retries for HSM throttled operations in some scenarios on hsm2m.medium +Issue: Increased login latency on hsm2m.mediumIssue: Increased find key latency on hsm2m.mediumIssue: A CO using trying to set the trusted attribute of a key will fail with Client SDK 5.12.0 and earlierIssue: ECDSA verify will fail with Client SDK 5.12.0 and earlier for clusters in FIPS modeIssue: Only the PEM-formatted certificates can be registered as mtls trust anchors with CloudHSM CLIIssue: Customer applications will stop processing all requests when using mTLS with a passphrase protected client private key.Issue: User replicate fails when using the CloudHSM CLIIssue: Operations can fail during backup creationIssue: Client SDK 5.8 and above do not perform automatic retries for HSM throttled operations in some scenarios on hsm2m.medium @@ -14,0 +15,2 @@ The following issues impact all AWS CloudHSM hsm2m.medium instances. + * Issue: Increased find key latency on hsm2m.medium + @@ -40,0 +43,9 @@ The following issues impact all AWS CloudHSM hsm2m.medium instances. +## Issue: Increased find key latency on hsm2m.medium + + * **Impact:** The hsm2m.medium HSM instance has improved fair share architecture which results in more consistent predictable performance compared to hsm1.medium. With hsm1.medium, customers may observe higher find key performance due to irregular use of HSM resources. However, hsm1.medium find key performance will decrease when the HSM instance is patched or updated with new firmware. This issue affects operations such as `KeyStore.getKey()` in JCE. + + * **Workaround:** We are working to improve our HSM firmware. As best practice, cache the results from find key operations. Caching will reduce the total number of find key operations as it is a resource intensive operation in HSM. In addition, implement client-side retries with exponential backoff and jitter to reduce HSM throttling failures. + + + +