IaC Bazaar
Browse modules
Menu
AWSStatic-verified

A CloudHSM Cluster, Honest About What It Cannot Do

Cluster and HSMs, with the parts nobody mentions: AWS holds no copy of your keys, Terraform cannot initialise the cluster, and an uninitialised cluster bills per HSM per hour while being unable to store anything.

terraformAWSaws
aws-cloudhsmvizier v1.2.0

Verification

Static-verified

Passed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).

Conformance

  • Static validation (fmt · validate · tflint)
  • Security scan clean (Checkov)
  • Plan tests (mocked: validation rules · outputs)

Provenance

  • SHA-256 checksum
  • Signature (pending)

Functional

  • Live test pending (no cloud run yet)

Last verified 2026-09-12 · how we verify

Use it from the registry

terraform · opentofu
module "cloudhsm" {
  source  = "www.iac-bazaar.com/iac-bazaar/aws-cloudhsm/aws"
  version = "1.0.0"
}

Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.

Inputs & outputs

Create a free account to read this module's contract

The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.

A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.

Create a free account →Sign in

Documentation

aws-cloudhsm

A CloudHSM cluster and the HSMs in it. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

AWS holds no copy of your keys. That is what single-tenant means, and it is the reason to use CloudHSM rather than KMS: nobody at AWS can read the key material - and nobody at AWS can recover it for you. The service does take automatic cluster backups, so this is not "one mistake and it is gone", but those backups are the only copy, they are deleted on a retention timer once the cluster is deleted, and no support ticket reverses that.

Terraform cannot initialise the cluster. A new cluster is created UNINITIALIZED: somebody has to sign its certificate signing request with their own CA, upload the chain, and set the crypto officer password out of band. Until that happens the cluster exists, bills per HSM per hour, and cannot store a key. Nothing in this module does that step and nothing could - which is worth knowing before an apply that looks finished. The CSR and the cluster state are both outputs.

One HSM is not a cluster. With a single HSM there is no synchronous replica: losing it means restoring from a backup, and every key created since that backup is gone. Preconditions ask you to confirm a one-HSM cluster and a one-subnet cluster rather than letting either be a default nobody chose.

Two smaller things:

  • mode is fixed at creation. A NON_FIPS cluster stays NON_FIPS for its life, and moving is a new cluster plus a key migration - which matters because FIPS is what most people are buying CloudHSM for
  • HSMs are spread across the cluster's subnets by index rather than stacking in the first one, which is what happens when subnet_id is left to default
  • hsm_ip_addresses returns all of them. A client configured with one HSM's address does not fail over

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.

Usage code & full reference need an account

The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.

  • Usage
Create a free accountSign in

Related modules

Live-tested

aws-acm

Requests a public, DNS-validated ACM TLS certificate that ACM auto-renews forever, outputting the validation records to publish - CT logging on, wildcards and SANs supported.

View module
Static validatedLive test pending

aws-private-ca

A root or subordinate CA with revocation configured, its certificate installed in the same apply, and ACM permitted to issue from it. Documents the two traps: a CA bills through its deletion window, and one without CRL or OCSP can issue certificates it can never revoke.

View module
Live-tested

aws-kms

Customer-managed KMS keys with sane key policies, aliases, rotation, and multi-region replicas.

View module
Live-tested

aws-ssm-parameter-store

Map-driven SSM Parameter Store parameters - String, StringList, and SecureString - created from a single map, with SecureString always KMS-encrypted and the free Standard tier by default.

View module
Live-tested

aws-secrets-manager

Secrets with versioning, resource policies, replication, and optional Lambda rotation scaffolding.

View module