> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Use AWS CloudHSM for Infisical encryption

> Learn how to manage encryption using AWS CloudHSM

This guide provides instructions on securing Infisical project secrets using AWS CloudHSM.
Integration with AWS CloudHSM is achieved by configuring it as a custom key store for AWS KMS.
Follow the steps below to set up AWS KMS with AWS CloudHSM as the custom key store.

## Prepare AWS CloudHSM cluster

Before you get started, you'll need to configure a AWS CloudHSM cluster which meets the following criteria:

* The cluster must be active.
* The cluster must not be associated with any other AWS KMS custom key store.
* The cluster must be configured with private subnets in at least two Availability Zones in the Region.
* The security group for the cluster must include inbound and outbound rules that allow TCP traffic on ports 2223-2225.
* The cluster must contain at least two active HSMs in different Availability Zones.

For more details on setting up your cluster, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#before-keystore).

## Set up AWS KMS custom key store

To set up an AWS KMS custom key store with AWS CloudHSM, you'll need the following:

* The trust anchor certificate of your AWS CloudHSM cluster.
* A `kmsuser` user in the AWS CloudHSM cluster with the crypto-user role.

**1. Navigate to Key store creation page**

In the AWS console, head over to `AWS KMS` > `AWS CloudHSM key stores` and select **Create key store**.

**2. Add key store name**

Input the custom key store name. ![Set key store name](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-key-store-name.png)

**3. Select HSM cluster**

Select the AWS CloudHSM cluster. You should be able to select the cluster if it meets the required criteria mentioned above.

![Set key store cluster](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-key-store-cluster.png)

**4. Upload trust anchor certificate**

Upload your CloudHSM's cluster trust anchor certificate file.

![Set key store cert](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-key-store-cert.png)

**5. Provide cluster user password**

Input the password of the `kmsuser` crypto-user in your cluster.

![Set key store password](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-key-store-password.png)

**6. Finish key store creation**

Proceed with creating the AWS CloudHSM key store.

For more details, refer to the following [AWS documentation](https://docs.aws.amazon.com/kms/latest/developerguide/create-keystore.html#create-keystore-console).

## Create AWS KMS key

Next, you'll need to create a AWS KMS key where you'll set the key store you created previously.

**1. Navigate to AWS KMS key creation page**

In your AWS console, proceed to `AWS KMS` > `Customer managed keys` and select **Create**.

**2. Set key options**

Set Key type to `Symmetric` and Key usage to `Encrypt and decrypt`.

![Set key options 1](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-kms-key-1.png)

**3. Select key material origin**

In the advanced options, for the Key material origin field, select `AWS CloudHSM key store`. Then, select next.

![Set key options 2](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-kms-key-2.png)

**4. Choose key store**

Select the AWS CloudHSM key store you created earlier.

![Select HSM 1](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/platform/kms/aws-hsm/create-kms-select-hsm.png)

**5. Finish KMS key creation**

Proceed with creating the AWS KMS Key.

## Connect Infisical to AWS KMS key

You should now have an AWS KMS that has a custom key store set to AWS CloudHSM.
To secure project resources, you'll need to add this AWS KMS to your Infisical organization. To learn how, refer to the documentation [here](https://infisical.com/docs/documentation/platform/kms-configuration/aws-kms.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.