1 - Create CloudHSM Cluster

AWS CloudHSM provides Hardware Security Modules (HSMs) in a cluster, a collection of individual HSMs that AWS CloudHSM keeps in sync.

When you create a cluster, you specify an Amazon Virtual Private Cloud (VPC) and a Subnet in the Availability Zone (AZ) of your instance. You then create an HSM in your cluster, selecting an Availability Zone (AZ) for the creation of the HSM.

Follow the steps below to create a cluster and an HSM:

1. Navigate to the AWS CloudHSM console on https://console.aws.amazon.com/cloudhsm.

2. Click Create Cluster.

3. In the Cluster configuration section, select the VPC and Subnet in the Availability Zone (AZ) of your EJBCA Enterprise Cloud Instance.
   Wait for the cluster creation process to complete.

4. When the cluster creation process is completed, the cluster will be in an Uninitialized state. Click Initialize.

5. Choose an Availability Zone (AZ) to create the HSM in.

6. Click Create and wait for the HSM to be created. Click Refresh after a few minutes.

7. When the HSM is created, the wizard will show you the HSM created. Click Next to continue.

8. In Download certificate signing request, download the four certificates to authenticate the HSM cluster:

   1. Cluster CSR

   2. HSM certificate

   3. AWS certificate

   4. Manufacturer certificate

The certificates are used in the next step, see2 - Validate the HSM.