AWS Security ChangesHomeSearch

AWS cloudhsm medium security documentation change

Service: cloudhsm · 2026-02-25 · Security-related medium

File: cloudhsm/latest/userguide/cloudhsm-audit-log-reference.md

Summary

Added two new audit log operation codes: CN_ENCRYPT_SESSION_V2 and END_MARKER_OPCODE

Security assessment

Added documentation for encrypted session establishment (CN_ENCRYPT_SESSION_V2) and security boundary enforcement (END_MARKER_OPCODE). These directly document security controls for cryptographic operations and audit log integrity.

Diff

diff --git a/cloudhsm/latest/userguide/cloudhsm-audit-log-reference.md b/cloudhsm/latest/userguide/cloudhsm-audit-log-reference.md
index 0d2a13db8..99876576d 100644
--- a//cloudhsm/latest/userguide/cloudhsm-audit-log-reference.md
+++ b//cloudhsm/latest/userguide/cloudhsm-audit-log-reference.md
@@ -40,0 +41,3 @@ Operation Code (Opcode) | Description
+**Session Management**  
+`CN_ENCRYPT_SESSION_V2 (0x107)` | Establishes an authenticated end-to-end encrypted session.  
+`END_MARKER_OPCODE (0xffff)` | Inserts an end-marker in the audit logs buffer indicating no more loggable commands are allowed on the HSM