How can I share CloudHSM clusters with other AWS accounts?

Short description

You can use AWS Resource Access Manager to share subnets for the Amazon Virtual Private Cloud (Amazon VPC) containing your CloudHSM with other AWS accounts.

Resolution

Use AWS RAM to access CloudHSM with another AWS account in AWS Organizations. In the following example, Account 1 contains the CloudHSM cluster, and Account 2 contains the CloudHSM client instance.

Use AWS RAM to enable sharing

1. With your Organizations management account, open the AWS RAM console in the same Region as your CloudHSM, and choose Settings.
2. Select the Enable sharing within your AWS Organization check box.
3. With your Organizations management account, open the AWS Organization Console.
4. Choose Settings, and note the Organization ID.

Create a resource share with Account 1 for with other accounts

1. Open the AWS RAM console with Account 1 in the same Region as your CloudHSM.
2. In the navigation pane, in Shared by me, choose Resource shares.
3. Choose Create resource share.
4. In Name, enter a name for the resource share.
5. In Resources, choose the Amazon VPC subnet ID for your CloudHSM.
6. In Principals, uncheck select Allow external accounts.
7. In the Add AWS account number search pane, enter the Organization ID, choose Add, and then choose Create resource share.

Note: You can also share Organizational Units (OUs) and AWS accounts.

Configure the security group to allow the CloudHSM client to connect to the CloudHSM cluster

1. Open the CloudHSM console with Account 1 in the same Region as your CloudHSM cluster.
2. In the navigation pane, choose Clusters.
3. In Cluster ID, choose the CloudHSM cluster that you want to share.
4. In Security group, choose the security group.
5. Choose the Inbound tab, and then choose Edit.
6. Choose Add Rule.
7. In Port Range, enter 2223-2225.
8. In Source, enter the private IP address of your client instance, and then choose Save.

Note: To get the client instance private IP address, see view the IPv4 addresses using the EC2 console.

Create client instances for the subnets shared with Account 2

1. Open the Amazon EC2 console with Account 2, choose Launch Instance, and then select an Amazon Machine Image (AMI).
2. Choose Next: Configure Instance Details.
3. In Network, choose the Amazon VPC that's shared with Account 2.
4. In Subnet, choose the subnet that's shared with Account 2.
5. In Auto-assign Public IP, choose Enable, and then choose Next: Add Storage.
6. Choose Next: Add Tags, and then choose Next: Configure Security Group.
7. In Assign a security group, choose either Create a new security group or Select an existing security group (depending on your instance type).
8. Choose Review and Launch, and then choose Launch.
9. Choose an existing key pair or create a new one (depending on your instance type), and then select the agreement check box.
10. Choose Launch Instances.

Related information

Sharing your AWS resources

Working with security groups

Shared subnets permissions