AWS cloudhsm documentation change
Summary
Updated documentation to clarify that HSM user synchronization is not server-side and can lead to inconsistencies, with a new troubleshooting link.
Security assessment
The change informs users about a limitation in user synchronization that could impact security, but there is no concrete evidence of addressing a specific security vulnerability or incident.
Diff
diff --git a/cloudhsm/latest/userguide/cluster-synchronization.md b/cloudhsm/latest/userguide/cluster-synchronization.md index 3c1876c75..d73132d78 100644 --- a//cloudhsm/latest/userguide/cluster-synchronization.md +++ b//cloudhsm/latest/userguide/cluster-synchronization.md @@ -9 +9 @@ -In an AWS CloudHSM cluster, AWS CloudHSM keeps the keys on the individual HSMs in sync. You don't need to do anything to synchronize the keys on your HSMs. To keep the users and policies on each HSM in sync, update the AWS CloudHSM client configuration file before you [manage HSM users](./manage-hsm-users.html). For more information, see [Keep HSM users in sync](./troubleshooting-keep-hsm-users-in-sync.html). +In an AWS CloudHSM cluster, AWS CloudHSM keeps the keys on the individual HSMs in sync. You don't need to do anything to synchronize the keys on your HSMs. Unlike keys, there is no server-side mechanism to synchronize HSM users across the cluster. The AWS CloudHSM CLI performs best-effort synchronization of user operations across HSMs, but inconsistencies can occur if an operation partially fails. If users become out of sync, the `user list` command will show inconsistencies. For more information, see [Client SDK 5 user contains inconsistent values](./troubleshoot-sdk5-inconsistent-value.html).