AWS cloudhsm medium security documentation change
Summary
Clarified that automatic synchronization only applies to keys (not users/policies) and added explicit statement about manual resolution for user/policy inconsistencies
Security assessment
The change explicitly documents that user/policy configurations (including mTLS settings) aren't automatically synchronized, creating potential security gaps if inconsistencies occur. This highlights a security consideration for HSM administrators.
Diff
diff --git a/cloudhsm/latest/userguide/cluster-synchronization.md b/cloudhsm/latest/userguide/cluster-synchronization.md index d73132d78..aeb71bf7e 100644 --- a//cloudhsm/latest/userguide/cluster-synchronization.md +++ b//cloudhsm/latest/userguide/cluster-synchronization.md @@ -9 +9 @@ -In an AWS CloudHSM cluster, AWS CloudHSM keeps the keys on the individual HSMs in sync. You don't need to do anything to synchronize the keys on your HSMs. Unlike keys, there is no server-side mechanism to synchronize HSM users across the cluster. The AWS CloudHSM CLI performs best-effort synchronization of user operations across HSMs, but inconsistencies can occur if an operation partially fails. If users become out of sync, the `user list` command will show inconsistencies. For more information, see [Client SDK 5 user contains inconsistent values](./troubleshoot-sdk5-inconsistent-value.html). +In an AWS CloudHSM cluster, AWS CloudHSM keeps the keys on the individual HSMs in sync. You don't need to do anything to synchronize the keys on your HSMs. Unlike keys, there is no server-side mechanism to synchronize HSM users across the cluster. The AWS CloudHSM CLI performs best-effort synchronization of user operations across HSMs, but inconsistencies can occur if an operation partially fails. If users become out of sync, the `user list` command will show inconsistencies. For more information, see [Client SDK 5 user or policy contains inconsistent values](./troubleshoot-sdk5-inconsistent-value.html). @@ -13 +13,3 @@ When you add a new HSM to a cluster, AWS CloudHSM makes a backup of all keys, us -If the HSMs in a cluster fall out of synchronization, AWS CloudHSM automatically resynchronizes them. To enable this, AWS CloudHSM uses the credentials of the [appliance user](./understanding-users.html). This user exists on all HSMs provided by AWS CloudHSM and has limited permissions. It can get a hash of objects on the HSM and can extract and insert masked (encrypted) objects. AWS cannot view or modify your users or keys and cannot perform any cryptographic operations using those keys. +If the keys on HSMs in a cluster fall out of synchronization, AWS CloudHSM automatically resynchronizes them. To enable this, AWS CloudHSM uses the credentials of the [appliance user](./understanding-users.html). This user exists on all HSMs provided by AWS CloudHSM and has limited permissions. It can get a hash of objects on the HSM and can extract and insert masked (encrypted) objects. AWS cannot view or modify your users or keys and cannot perform any cryptographic operations using those keys. + +This automatic resynchronization applies only to keys. Users and policies (such as mTLS settings) are not automatically resynchronized. The CloudHSM CLI performs best-effort synchronization of user and policy operations across HSMs, but inconsistencies can still occur and you may need to resolve them manually. For more information, see [Client SDK 5 user or policy contains inconsistent values](./troubleshoot-sdk5-inconsistent-value.html).