Cluster

Source: src/AWS/CloudHSMV2/Cluster.ts

An AWS CloudHSM cluster — a fleet of FIPS-validated, single-tenant hardware security modules (HSMs) inside your VPC.

A fresh cluster provisions to the UNINITIALIZED state in a few minutes and holds no HSMs; add Hsm resources to place HSMs into its subnets’ Availability Zones (each HSM is billed hourly). Activating the cluster (signing the cluster CSR and calling InitializeCluster) is an offline certificate-authority ceremony that stays out of band — the clusterCsr attribute exposes the CSR to sign.

Creating a Cluster

Cluster Spanning Two Availability Zones

const cluster = yield* Cluster("HsmCluster", {
  hsmType: "hsm2m.medium",
  subnetIds: [subnetA.subnetId, subnetB.subnetId],
});

Non-FIPS Cluster with Custom Backup Retention

const cluster = yield* Cluster("HsmCluster", {
  hsmType: "hsm2m.medium",
  subnetIds: [subnetA.subnetId, subnetB.subnetId],
  mode: "NON_FIPS",
  backupRetention: "30 days",
});

Adding HSMs

const cluster = yield* Cluster("HsmCluster", {
  hsmType: "hsm2m.medium",
  subnetIds: [subnetA.subnetId, subnetB.subnetId],
});
const hsm = yield* Hsm("Primary", {
  clusterId: cluster.clusterId,
  availabilityZone: "us-west-2a",
});