aws-cloudhsm-extractable-key-material-data-plane
An HSM user can export key material that was created or imported as extractable; access is governed by CloudHSM user credentials, not an AWS read API.
Where it sits
| location | CloudHSM client PKCS#11/JCE/OpenSSL key object with EXTRACTABLE=true |
|---|
| location kind | secret_value |
|---|
| data kinds | private_key encryption_key_material signing_secret credential |
|---|
| emits edge | ExposesCredential |
|---|
| service | CloudHSM (aws:cloudhsm) |
|---|
Collection recipe
| access mode | data_plane |
|---|
| operation | PKCS#11 C_WrapKey / JCE key export |
|---|
| response path | protocol key bytes or wrapped key bytes |
|---|
| encoding | binary |
|---|
| params | {"ClusterId": "\u003ccluster-id\u003e", "KeyHandle": "\u003ckey-handle\u003e"} |
|---|
References