{"templateId":"markdown","versions":[{"version":"v1.40","label":"v1.40 STS","link":"/products/custody/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":true,"active":false,"folderId":"c15a2701"},{"version":"v1.39","label":"v1.39 STS","link":"/products/custody/v1.39/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.38","label":"v1.38 STS","link":"/products/custody/v1.38/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":false,"active":true,"folderId":"c15a2701"},{"version":"v1.34","label":"v1.34 LTS","link":"/products/custody/v1.34/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.26","label":"v1.26 LTS","link":"/products/custody/v1.26/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.19","label":"v1.19 LTS","link":"/products/custody/v1.19/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":false,"active":false,"folderId":"c15a2701"},{"version":"v1.15","label":"v1.15 LTS","link":"/products/custody/v1.15/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","default":false,"active":false,"folderId":"c15a2701"}],"sharedDataIds":{"sidebar":"sidebar-products/custody/@v1.15/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"AWS CloudHSM","description":"User guides, API reference, and support resources.","siteUrl":"https://docs.ripple.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"aws-cloudhsm","__idx":0},"children":["AWS CloudHSM"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Ripple Custody"," supports AWS CloudHSM in a hybrid deployment model, consisting of:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Vaults in AWS Nitro enclaves"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["AWS CloudHSM in a single or multi-HSM cluster in AWS Cloud"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"cloud","__idx":1},"children":["Cloud"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["At least two AWS CloudHSM instances are deployed in an AWS cluster to ensure high availability of the master key."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"key-generation","__idx":2},"children":["Key generation"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For key generation, ","Ripple Custody"," supports AES (Advanced Encryption Standard) symmetric encrypt operations with AWS wrapping."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The characteristics of the AWS wrapping approach are as follows:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Keys are double-wrapped in ","Ripple Custody"," and AWS Cloud, and then stored in ","Ripple Custody","."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["All ledger types are supported."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Additional security is needed in the form of strict policies."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"aws-wrapping","__idx":3},"children":["AWS wrapping"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["With the AWS wrapping approach, keys are generated and stored as follows:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["During account creation, ","Ripple Custody"," generates a key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Ripple Custody"," passes the key to the AWS CloudHSM cluster to wrap it with the wrapping key."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Ripple Custody"," passes the wrapped key back to the vault and stores it in ","Ripple Custody","."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"database-backups","__idx":4},"children":["Database backups"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Since the database is in the Ripple Cloud environment, regular database backups are performed by Ripple according to industry best practices."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"deploy-aws-cloudhsm-with-ripple-custody","__idx":5},"children":["Deploy AWS CloudHSM with ","Ripple Custody"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To use AWS CloudHSM with ","Ripple Custody",", you need to:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Deploy and initialize AWS CloudHSM. ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/integrate-kms/cloud-hsm/aws-cloudhsm-initialize"},"children":["Initialize an AWS CloudHSM"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Deploy a vault to an AWS enclave. ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"/products/custody/v1.38/deployment/integrate-kms/cloud-hsm/aws-cloudhsm-connect"},"children":["Deploy a vault"]},"."]}]}]},"headings":[{"value":"AWS CloudHSM","id":"aws-cloudhsm","depth":1},{"value":"Cloud","id":"cloud","depth":2},{"value":"Key generation","id":"key-generation","depth":3},{"value":"AWS wrapping","id":"aws-wrapping","depth":4},{"value":"Database backups","id":"database-backups","depth":3},{"value":"Deploy AWS CloudHSM with Ripple Custody","id":"deploy-aws-cloudhsm-with-ripple-custody","depth":3}],"frontmatter":{"seo":{"title":"AWS CloudHSM"}},"lastModified":"2026-07-27T10:10:43.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/products/custody/v1.38/deployment/integrate-kms/cloud-hsm/aws-cloudhsm","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}