CloudHSM restore | A how to guide

CloudHSM restore via Console and AWS CLI made easy with guidance from the in-house experts at Bobcares. 

At Bobcares, we offer solutions for every query, big and small, as a part of our Server Management Service.

Let’s take a look at how our Support Team recently helped a customer when they wanted to restore their CloudHSM clusters from a backup.

How to restore CloudHSM cluster

Restoring an AWS CloudHSM cluster from a backup is no longer a chore. Our Support Team has come up with this handy guide to help you get started. In order to proceed with the restoration, we need to create a cluster and specify the backup for the restoration.

Furthermore, we have to make sure that we do not initialize or activate the cluster after creating it. Let’s take a look at this process in detail.

Restore CloudHSM: How to create clusters from backups (Console)

1. First, we will open the AWS CloudHSM console at this link.
2. Then, we have to choose Create cluster.
3. Next, we will navigate to the Cluster configuration section and then proceed with these steps:
   • For VPC, select a VPC for the cluster we are creating.
   • For AZ(s), select a private subnet for every Availability Zone we are adding to the cluster.
4. After that, we head to the Cluster source section and follow these steps:
   • Select Restore cluster from existing backup.
   • Select the backup that we are restoring.
5. Then, we will select Next: Review
6. After that, we will review the cluster configuration by choosing Create cluster.
7. Next, we have to specify how long the backups have to be retained.

   We can either select the default retention period of 90 days or opt for any value between 7 to 379 days. The service automatically deletes backups on the cluster older than the value we specify here. Moreover, we can change this value later as well.
8. Then, select Next.
9. This is an optional step. It involves typing a tag key and an optional tag value. We can add more than one tag to the cluster by selecting Add tag.
10. After that, we select Review.
11. Finally, we review the cluster configuration and select Create cluster.

According to our Support Techs, we can create an HSM in this cluster with the same users. Certificates, key material, configuration, and policies as in the backup that we restored. This is done by adding an HSM to the cluster.

Restore CloudHSM: How to create clusters from backups (AWS CLI)

First, we will execute the describe-backups command to get the backup.

After that, we will execute the create-cluster command. We will specify the HSM instance type, the backup ID of the backup to be restored, and the subnet IDS of the subnets where we will be creating HSMs.

aws cloudhsmv2 create-cluster --hsm-type hsm1.medium \
                                --subnet-ids <subnet ID 1> <subnet ID 2> <subnet ID N> \
                                --source-backup-id <backup ID>

{
    "Cluster": {
        "HsmType": "hsm1.medium",
        "VpcId": "vpc-641d3c0d",
        "Hsms": [],
        "State": "CREATE_IN_PROGRESS",
        "SourceBackupId": "backup-rtq2dwi2gq6",
        "BackupPolicy": "DEFAULT",
        "BackupRetentionPolicy": {
            "Type": "DAYS",
            "Value": 90
         }, 
        "SecurityGroup": "sg-640fab0c",
        "CreateTimestamp": 1504907311.112,
        "SubnetMapping": {
            "us-east-2c": "subnet-0e358c43",
            "us-east-2a": "subnet-f1d6e798",
            "us-east-2b": "subnet-40ed9d3b"
        },
        "Certificates": {
            "ClusterCertificate": ""
        },
        "ClusterId": "cluster-jxhlf7644ne"
    }
}

[Require assistance with another query? Give us a call.]

Conclusion

To sum up, the skilled Support Engineers at Bobcares demonstrated how to restore an AWS CloudHSM cluster from a backup.