THURSDAY, APRIL 25, 2019 CloudHSM client container based on Ubuntu with CloudHSM client, PKCS#11 library and PyKCS11 module installed and ready to use within a Docker/Kubernetes.

Docker Hub: https://hub.docker.com/r/walkerk1980/cloudhsm-pkcs11-python
View the code on GitHub: https://github.com/walkerk1980/cloudhsm-pkcs11-python

Prerequisites:

Container host Instance requires either an EC2 Instance Profile to be attached to the host Instance with IAM permissions that allow the container to pull the CloudHSM Cluster information or you can alternatively pass the container IAM Access Key Credential via Docker Environment Variables. [1][2]

[1] Using Instance Profiles - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html

[2] Environment Variables - https://docs.aws.amazon.com/cli/latest/userguide/cli-environment.html

This container requires you to provide the CLUSTERID of an HSM Cluster with at least one running HSM in the same Region/VPC as the host.

The Cluster/HSM requires the proper Security Groups allowing the Instance/Container to communicate with the Cluster.

For more information please see the CloudHSM documentation. [3]

  [3] Getting Started with AWS CloudHSM - https://docs.aws.amazon.com/cloudhsm/latest/userguide/getting-started.html

Getting Started:

$ docker volume create --name cloudhsm_data

$ docker run -it -d --rm --name cloudhsm -v cloudhsm_data:/root/data/ walkerk1980/cloudhsm-pkcs11-python /bin/bash

$ docker cp /path/to/customerCA.crt cloudhsm:/root/data/

$ docker stop cloudhsm

$ docker run -it -d -e CLUSTERID=cluster-5la5cwabs7v -v cloudhsm_data:/root/data --name cloudhsm -e REGION=us-west-2 walkerk1980/cloudhsm-pkcs11-python /usr/local/bin/startup.sh

Example commands once the container is running:

ensure that client is connected: 

$ docker logs cloudhsm

connect to bash on container: 

$ docker exec -it cloudhsm

Within bash - create CA: 

$ createCA.sh

Within bash - CloudHSM Managment Utilitiy: 

$ /opt/cloudhsm/bin/cloudhsm_mgmt_util /opt/cloudhsm/etc/cloudhsm_mgmt_util.cfg

ENVIRONMENT VARIABLES:

CLUSTERID is for the Cluster Id of your initialized CloudHSM Cluster containing at least one running HSM.

REGION is for the AWS Region that your CloudHSM Cluster is located in.

CASUBJECT (Optional) is for the subject of the local CA to be created.

CAKEYPASS (Optional) is for the local CA private key password.

AWS_ACCESS_KEY_ID (Optional) is for pulling requried cluster information if Instance Profile is not used.

AWS_SECRET_ACCESS_KEY (Optional) is for pulling requried cluster information if Instance Profile is not used.

AWS_SESSION_TOKEN (Optional) is for pulling requried cluster information if Instance Profile is not used.

Internal Container Commands:

createCA.sh - Set up the local CA using the information provided in CASUBJECT and CAKEYPASS. This will create an openssl CA and move it to the data volume

cainfo.sh - Get info about the customerCA.crt in place within the container