aws-samples / aws-samples/aws-cloudhsm-jce-examples
How to sync AWS Cloud HSM keystore file across application on different aws instances?
- Dominant language
- Java
- Stars
- 46
- Forks
- 70
- Avg merge
- 52m
- Merged PRs (30d)
- 4
Description
**Requirement:**
We have an application running on more than one instance in a cluster that uses key pairs, certificates, and symmetric keys which are preloaded in AWS Cloud HSM.
What is the best way to provide the local keystore file which is created when generating key pairs to all the machines in the cluster?
Keys are created on a different instance which is exclusively used on key management only.
When a new key pair is added, that keypair + certificate needs to be available on all application instances.
**Generate keypair with a certificate with store file**
```
keytool -genkeypair -alias alias1 -keystore /home/user/my_cloudhsm/my-cloudhsm.store "CN=alias1.example.com, OU=Research, O=Acme, L=XYZ, ST=CA, C=US" -storetype CLOUDHSM -storepass password -keyalg rsa -keysize 2048 -sigalg sha512withrsa -validity 360 -dname -J-classpath '-J/opt/cloudhsm/java/*' -J-Djava.library.path=/opt/cloudhsm/lib
```
Contributor guide
Research direction
Start by examining the AWS CloudHSM JCE keystore behavior and the shown keytool command, focusing on how the local my-cloudhsm.store file is created and consumed. Determine what supported approach would make a newly generated key pair and certificate available to every application instance, and document the resulting completion criteria.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, java
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100