AWS cloudhsm documentation change

Service: cloudhsm · 2026-01-13 · Documentation low

File: cloudhsm/latest/userguide/configure-tool-examples5.md

Summary

Added multiple configuration examples for OpenSSL provider: bootstrapping EC2 instances, disabling key durability, logging configuration, and certificate placement

Security assessment

Documents security feature configurations (key management, logging, certificate handling) but shows no evidence of patching vulnerabilities. Enhances security operations documentation.

Diff

diff --git a/cloudhsm/latest/userguide/configure-tool-examples5.md b/cloudhsm/latest/userguide/configure-tool-examples5.md
index ecae74c36..e0d325c36 100644
--- a//cloudhsm/latest/userguide/configure-tool-examples5.md
+++ b//cloudhsm/latest/userguide/configure-tool-examples5.md
@@ -43,0 +44,12 @@ OpenSSL Dynamic Engine
+OpenSSL Dynamic Engine Provider
+    
+
+###### To bootstrap a Linux EC2 instance for Client SDK 5
+
+  * Use the configure tool to specify the IP address of an HSM in your cluster. 
+    
+        $ sudo /opt/cloudhsm/bin/configure-openssl-provider -a <HSM IP addresses>
+
+
+
+
@@ -465,0 +478,12 @@ OpenSSL Dynamic Engine
+OpenSSL Dynamic Engine Provider
+    
+
+###### To disable client key durability for Client SDK 5 on Linux
+
+  * Use the configure tool to disable client key durability settings. 
+    
+        $ sudo /opt/cloudhsm/bin/configure-openssl-provider --disable-key-availability-check
+
+
+
+
@@ -601,0 +626,35 @@ Linux
+OpenSSL Dynamic Engine Provider
+    
+
+###### Default logging location
+
+  * If you do not specify a location for the file, the system writes logs to the following default location:
+
+Linux
+    
+        stderr
+
+
+
+
+###### To configure the logging level and leave other logging options set to default
+
+  *     $ sudo /opt/cloudhsm/bin/configure-openssl-provider --log-level info
+
+
+
+
+###### To configure file logging options
+
+  *     $ sudo /opt/cloudhsm/bin/configure-openssl-provider --log-type file --log-file <file name with path> --log-rotation daily --log-level info
+
+
+
+
+###### To configure terminal logging options
+
+  *     $ sudo /opt/cloudhsm/bin/configure-openssl-provider --log-type term --log-level info
+
+
+
+
@@ -751,0 +811,12 @@ OpenSSL Dynamic Engine
+OpenSSL Dynamic Engine Provider
+    
+
+###### To place the issuing certificate on Linux for Client SDK 5
+
+  * Use the configure tool to specify a location for the issuing certificate. 
+    
+        $ sudo /opt/cloudhsm/bin/configure-openssl-provider --hsm-ca-cert <customerCA certificate file>
+
+
+
+