Introduction

This document describes how to deploy an AWS Key Management Service (KMS) External Key Store (XKS) supported by an Entrust nShield Hardware Security Module (HSM).

Overview

AWS KMS External Key Store helps organizations meet regulatory requirements for storing encryption keys outside the AWS Cloud. With this feature, AWS KMS customer managed keys can be protected by your own Entrust nShield HSM or by nShield as a service (nSaaS) within AWS data centers.

To enable AWS KMS External Key Store, the AWS KMS key hierarchy is extended with an external root of trust. The root keys are generated and stored within your nShield HSM. When encryption or decryption of a data key is required, AWS KMS forwards the request to your nShield HSM through an external key store proxy (XKS proxy) that you manage.

The XKS proxy plays a critical role in mediating all interactions between AWS KMS and your Entrust nShield HSM. It translates AWS KMS requests into a format understood by your Entrust nShield HSM, enabling seamless communication between the two systems.

Product configuration

Entrust tested the integration with the following versions:

Product Version

Operating System

AWS Linux

An Amazon Linux EC2 instance was used for this deployment. However, the choice of Linux distribution may vary depending on your organization’s preferences, standards, and toolset. Adapt the deployment process as necessary to meet your specific requirements and infrastructure.

Supported nShield hardware and software versions

Entrust has successfully tested the integration with the following nShield hardware and software versions:

HSM Security World Software Firmware Netimage

Connect 5c

13.9.5

13.8.4

13.9.5

nShield XC

13.9.5

13.8.3

13.9.5

Supported nShield features

Entrust has successfully tested nShield HSM integration with the following features:

Feature Supported

Module Only Key

Yes

nSaaS

Supported but not tested

Requirements

You must have:

This integration uses public endpoint connectivity for AWS XKS. This means that:

  • The external key store proxy must be reachable through a publicly routable endpoint.

  • You must obtain a TLS certificate issued by an AWS KMS XKS Proxy API specification trusted certificate authority.

  • The Subject Common Name (CN) on the TLS certificate must match the domain name specified in the proxy URI endpoint for the external key store proxy.
    For example, if the public endpoint is https://myproxy.xks.example.com, the CN on the TLS certificate must be myproxy.xks.example.com or *.xks.example.com.

  • The AWS security group must allow custom TCP traffic between the AWS EC2 instance and the remote nShield HSM or nSaaS.

You should also familiarize yourself with:

  • The AWS Key Management Service External Key Store Documentation.

  • The nShield Documentation.

  • Your organization’s certificate policy, certificate practice statement (CPS), and any security policies or procedures governing the administration of the PKI and HSM environment.

  • The number of Administrator Cards in the Administrator Card Set (ACS), the quorum required for administrative operations, and the policies governing the management of these cards.

  • The Security World compliance level. For more information, see FIPS 140 Level 3 compliance.

  • Key attributes and requirements, such as key size, timeout settings, audit requirements, and key usage policies.

  • Whether the Security World should be instantiated as recoverable or non-recoverable.