# AWS CloudHSM

Ripple Custody supports AWS CloudHSM in a hybrid deployment model, consisting of:

- Vaults in AWS Nitro enclaves
- AWS CloudHSM in a single or multi-HSM cluster in AWS Cloud


## Cloud

At least two AWS CloudHSM instances are deployed in an AWS cluster to ensure high availability of the master key.

### Key generation

For key generation, Ripple Custody supports AES (Advanced Encryption Standard) symmetric encrypt operations with AWS wrapping.

The characteristics of the AWS wrapping approach are as follows:

- Keys are double-wrapped in Ripple Custody and AWS Cloud, and then stored in Ripple Custody.
- All ledger types are supported.
- Additional security is needed in the form of strict policies.


#### AWS wrapping

With the AWS wrapping approach, keys are generated and stored as follows:

1. During account creation, Ripple Custody generates a key.
2. Ripple Custody passes the key to the AWS CloudHSM cluster to wrap it with the wrapping key.
3. Ripple Custody passes the wrapped key back to the vault and stores it in Ripple Custody.


### Database backups

Since the database is in the Ripple Cloud environment, regular database backups are performed by Ripple according to industry best practices.

### Deploy AWS CloudHSM with Ripple Custody

To use AWS CloudHSM with Ripple Custody, you need to:

1. Deploy and initialize AWS CloudHSM. [Initialize an AWS CloudHSM](/products/custody/v1.34/how-to/integrate-kms/aws-cloudhsm/initialize).
2. Deploy a vault to an AWS enclave. [Deploy a vault](/products/custody/v1.34/how-to/integrate-kms/aws-cloudhsm/connect).