Manage HSM instances and clusters

Enable an HSM instance

Enabling an HSM instance is a one-time configuration step that attaches the instance to your Virtual Private Cloud (VPC) and prepares it to join a cluster.

Before you begin:

• When creating an HSM cluster, enable only the master HSM instance. Non-master HSM instances do not need to be enabled separately.

• If you created an HSM instance from an image, skip this step. For details, see Data backup and restore.

Steps:

1. Go to the VSMs page. In the top navigation bar, select the destination region.

2. Find the HSM instance. In the Actions column, click Enable.

3. In the Configure HSM Instance dialog box, set the following parameters and click OK. After configuration completes, the Status column changes to Enabled.

   Parameter	Description
   VPC ID	Select the VPC to attach to the HSM instance. This must be the same VPC as your ECS instance.
   VPC Subnet	Select the subnet CIDR block of the VPC.
   Private IP Address	Assign a private IP address within the subnet CIDR block. IP addresses ending in 253, 254, or 255 are system-reserved — do not use them.
   Configure HSM Whitelist	Enter one IP address or CIDR block per line. Maximum 10 entries. If left blank, all IP addresses can access the instance. If configured, only listed IPs are allowed. You cannot use 0.0.0.0/0. For temporary testing that requires open access, leave the whitelist blank.

Modify HSM instance configuration

What you can modify depends on whether the instance belongs to a cluster:

• Standalone instance (not in a cluster): VPC, vSwitch, private IP address, and whitelist.

• Cluster member: Private IP address only.

Steps:

1. On the VSMs page, find the target HSM instance. In the Actions column, click the icon, then click Config.

2. In the Configure HSM Instance dialog box, update the configuration and click OK.

Disable an HSM instance

Disable an HSM instance before resetting it or removing it from a cluster. Disabling disconnects the instance from the network.

Steps:

1. On the VSMs page, find the target HSM instance. In the Actions column, click Disable.

2. In the dialog box, click Disable again. The Status column changes to Disabled.

Recover an HSM instance

Resume a disabled HSM instance to re-enable its services.

Steps:

1. On the VSMs page, find the target HSM instance. In the Actions column, click Enable.

2. In the dialog box, click Enable again. The Status column changes to Enabled.

Reset an HSM instance

Resetting clears all data in the HSM instance and restores it to factory settings. The instance returns to an uninitialized state.

This operation is available only for instances in the Chinese mainland. The instance must be disabled before you can reset it.

Steps:

1. Disable the HSM instance.

2. On the VSMs page, find the target HSM instance. In the Actions column, click Reset.

3. In the dialog box, click Reset again.

Whitelist precedence

When an HSM instance belongs to a cluster, the cluster whitelist takes precedence over the instance's own whitelist. For example, if an instance whitelist allows 10.10.10.10 but the cluster whitelist specifies 172.16.0.1, only requests from 172.16.0.1 are accepted.

Scale out a cluster

Add HSM instances from different zones to a cluster to improve high availability of the encryption service. Each instance added to the cluster must meet all of the following requirements:

• Not initialized.

• In Enabled or New state.

• The same type as the master HSM.

• Either not configured with a vSwitch, or on the same vSwitch as the master HSM.

Steps:

1. On the VSMs page, find the master HSM instance. In the Actions column, click Expand Cluster.

2. In the Add HSM dialog box, add an instance using one of the following methods:

   • No existing instance: Click Purchase an HSM instance. The purchased instance is automatically added to the cluster. CloudHSM allocates an IP address to it and synchronizes cluster data automatically.

   • Existing instance: Select the instance, click the icon, and click OK.

Remove an instance from a cluster

Remove non-master HSM instances before removing the master HSM instance. If the cluster contains only the master HSM instance, remove it directly. Removing the master instance automatically deletes the cluster.

Each instance must be disabled before it can be removed.

Steps:

1. Disable the HSM instance:

   1. On the VSMs page, find the target HSM instance. In the Actions column, click Disable.

   2. In the dialog box, click Disable again.

2. On the VSMs page, find the target HSM instance. In the Actions column, click Remove from Cluster.

3. In the dialog box, click Remove from Cluster again.

Modify the cluster name and access whitelist

The cluster whitelist applies to all instances in the cluster and takes precedence over individual instance whitelists. You cannot configure 0.0.0.0/0. For temporary open access during testing, leave the whitelist blank.

Steps:

1. On the VSMs page, click the instance ID of any HSM instance (master or non-master) in the cluster.

2. On the Details tab, edit the cluster name and access whitelist. Enter one IP address or CIDR block per line. Maximum 10 entries.

Switch between master and non-master HSM

Manually promote a non-master HSM to be the master HSM of the cluster.

Master-slave switchover is supported only for clusters that do not use automatic synchronization.

Steps:

1. On the VSMs page, find the target non-master HSM instance. In the Actions column, click Switch to Master.

2. In the dialog box, click Switch.