AI BriefingHow Karrot Built a Large-Scale Signing Key Management System with AWS CloudHSM – Part 2: CloudHSM Architecture and Multi-Layer Access Control
Key point
Karrot leveraged AWS CloudHSM to design a security architecture with three layers of access control across the network, application, and HSM internals.
Details
To build a large-scale signing key management system for JWT token signing, Karrot designed an architecture based on AWS CloudHSM. This system consists of the Token Issuer within Amazon EKS, a dedicated HSM Access NodeGroup, and a CloudHSM Cluster deployed across multiple AZs.
To strengthen security, three layers of access control were applied. The first is the network level, where Istio's AuthorizationPolicy controls access so that only permitted workloads can connect, and a Zero Trust environment was implemented via Security Group and mTLS (mutual TLS) so that only authorized clients can communicate with the HSM.
The second is application-level control. HSM access subjects were clearly separated into administrators, signing applications, and general workloads to minimize privileges. In addition, AWS Secrets Manager and a Certbot CronJob were used to automate the secure management and automatic renewal of mTLS certificates.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Certificate Deep Dive Series 3: Zero Trust and mTLS
Amazon EKS Launches Direct Configuration for Managed Control Plane ParametersOptimizing Gemma 4 Serving with vLLM on Amazon EKS [Part 2: Throughput and Latency SLOs on a Single GPU]
Tailscale Didn't Stop the Hugging Face Intrusion