Architecture overview

The AWS security group must allow Custom TCP inbound and outbound traffic to and from the nShield HSM or nSaaS IP address. Multiple nShield HSMs can be deployed to provide high availability (HA) and increased throughput.

The minimum supported EC2 instance type is t3.large. More powerful EC2 instance types may also be used based on performance and capacity requirements.

The target group associated with the Network Load Balancer (NLB) must have the following characteristics:

The NLB must have the following characteristics:

The VPC endpoint service must have the following characteristics:

To enable the integration, you must designate an IAM user as the key administrator. This user will be responsible for managing the AWS KMS key and performing key administration tasks. The user may also be granted permissions to use the KMS key for cryptographic operations, as required by your organization’s security policies.

You can either select an existing IAM user or create a new one. When creating an access key for the IAM user, select Application running outside AWS as the use case to align with AWS access key best practices.

Add the following rules to the security group’s inbound and outbound rule sets to allow health check and XKS traffic.