cloudhsmv2

package
v1.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 33 Imported by: 0

README

Cloudhsmv2

Parity grade: B · SDK aws-sdk-go-v2/service/cloudhsmv2@v1.43.4 · last audited 2026-10-18 (acf0513c8)

Coverage

Metric Value
PARITY entries audited 18 (18 ok)
Feature families 3 (3 ok)
Known gaps 9
Structural gaps (can't be emulated) 3
Deferred items 0
Resource leaks clean
Known gaps
  • Certificates: AwsHardwareCertificate, HsmCertificate and ManufacturerHardwareCertificate are not emitted
  • Hsm.EniIpV6: DUALSTACK clusters get an IPv4 ENI only; no IPv6 address is allocated
  • Backups: no daily automatic backups; only the lifecycle points listed in the backups family
  • DescribeBackups Shared: only PutResourcePolicy grants are consulted; RAM resource shares are not
  • CopyBackupToRegion: same-account copies only; the destination region is a label on the stored backup, not a separate backend
  • ModifyCluster: the 7 day HsmTypeRollbackExpiration window is an assumption, the SDK does not state it
  • CloudHsmAccessDeniedException and CloudHsmServiceException: never raised; no IAM is modeled
  • ResourceGroupsTaggingAPI: cluster and backup tags are not exposed through the tagging API
  • CloudFormation: AWS::CloudHSM::Cluster and AWS::CloudHSM::HSM are not provisioned by the CloudFormation emulator
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • Cluster.PreCoPassword: the HSM user model (PRECO, CO, CU) does not exist, so no password can be real
  • Certificates hardware chain: there is no physical HSM to carry AWS or manufacturer hardware certificates
  • Cluster ACTIVE from a customer activation: real clusters become ACTIVE after the CloudHSM CLI activates them on the HSM; the emulator derives ACTIVE from an initialized cluster with an ACTIVE HSM

More

Documentation

Overview

Package cloudhsmv2 emulates the AWS CloudHSM v2 control plane: clusters, HSMs and backups.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrAccessDenied          = errors.New("access denied")
	ErrInternalFailure       = errors.New("internal failure")
	ErrInvalidRequest        = errors.New("invalid request")
	ErrResourceLimitExceeded = errors.New("resource limit exceeded")
	ErrResourceNotFound      = errors.New("resource not found")
	ErrService               = errors.New("service error")
	ErrTag                   = errors.New("invalid tag")
)

Sentinels, one per exception in the pinned SDK's error set.

Functions

This section is empty.

Types

type Backup 

type Backup struct {
	Created       time.Time         `json:"created"`
	ReadyAt       time.Time         `json:"readyAt"`
	CopyTime      time.Time         `json:"copyTime"`
	DeleteAt      time.Time         `json:"deleteAt"`
	Tags          map[string]string `json:"tags"`
	ID            string            `json:"id"`
	Account       string            `json:"account"`
	Region        string            `json:"region"`
	ClusterID     string            `json:"clusterId"`
	HsmType       string            `json:"hsmType"`
	Mode          string            `json:"mode"`
	ClusterCert   string            `json:"clusterCert,omitempty"`
	SourceBackup  string            `json:"sourceBackup,omitempty"`
	SourceCluster string            `json:"sourceCluster,omitempty"`
	SourceRegion  string            `json:"sourceRegion,omitempty"`
	Policy        string            `json:"policy,omitempty"`
	RetentionDays int               `json:"retentionDays"`
	NeverExpires  bool              `json:"neverExpires"`
}

Backup is a stored cluster backup.

type Cluster 

type Cluster struct {
	Created        time.Time         `json:"created"`
	ReadyAt        time.Time         `json:"readyAt"`
	InitUntil      time.Time         `json:"initUntil"`
	ModifyUntil    time.Time         `json:"modifyUntil"`
	RollbackExpiry time.Time         `json:"rollbackExpiry"`
	DeletedAt      time.Time         `json:"deletedAt"`
	DeleteUntil    time.Time         `json:"deleteUntil"`
	SubnetMapping  map[string]string `json:"subnetMapping"`
	Tags           map[string]string `json:"tags"`
	ID             string            `json:"id"`
	Account        string            `json:"account"`
	Region         string            `json:"region"`
	HsmType        string            `json:"hsmType"`
	Mode           string            `json:"mode"`
	NetworkType    string            `json:"networkType"`
	VpcID          string            `json:"vpcId"`
	SecurityGroup  string            `json:"securityGroup"`
	SourceBackupID string            `json:"sourceBackupId,omitempty"`
	CSR            string            `json:"csr"`
	ClusterCert    string            `json:"clusterCert,omitempty"`
	RetentionDays  int               `json:"retentionDays"`
	Initialized    bool              `json:"initialized"`
}

Cluster is a stored CloudHSM cluster.

type CreateClusterInput 

type CreateClusterInput struct {
	Retention      *wireRetention
	HsmType        string
	Mode           string
	NetworkType    string
	SourceBackupID string
	SubnetIDs      []string
	Tags           []wireTag
}

CreateClusterInput holds CreateCluster parameters.

type DeleteHsmInput 

type DeleteHsmInput struct {
	ClusterID, HsmID, EniID, EniIP string
}

DeleteHsmInput identifies the HSM to delete by one of its ID, ENI ID or ENI IP.

type DescribeBackupsInput 

type DescribeBackupsInput struct {
	Filters       map[string][]string
	MaxResults    *int32
	NextToken     string
	Shared        bool
	SortAscending bool
}

DescribeBackupsInput holds DescribeBackups parameters.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
}

Handler serves the CloudHSM v2 awsjson1.1 API.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler wraps a backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations lists the fault-injectable operations.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions lists the regions this handler serves.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase service name for fault rules.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name from X-Amz-Target.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the operation name; the API has no single resource key.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists every routed operation.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the echo handler.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches the BaldrApiService X-Amz-Target prefix.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable.

type Hsm 

type Hsm struct {
	Created     time.Time `json:"created"`
	ReadyAt     time.Time `json:"readyAt"`
	DeletedAt   time.Time `json:"deletedAt"`
	DeleteUntil time.Time `json:"deleteUntil"`
	ID          string    `json:"id"`
	ClusterID   string    `json:"clusterId"`
	Account     string    `json:"account"`
	Region      string    `json:"region"`
	Zone        string    `json:"zone"`
	SubnetID    string    `json:"subnetId"`
	EniID       string    `json:"eniId"`
	EniIP       string    `json:"eniIp"`
	HsmType     string    `json:"hsmType"`
}

Hsm is a stored HSM.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the CloudHSM v2 state; one coarse lock guards every table.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) CopyBackupToRegion 

func (b *InMemoryBackend) CopyBackupToRegion(
	ctx context.Context, id, destRegion string, tagList []wireTag,
) (wireDestinationBackup, error)

CopyBackupToRegion copies a ready backup into another region.

func (*InMemoryBackend) CreateCluster 

func (b *InMemoryBackend) CreateCluster(ctx context.Context, in CreateClusterInput) (wireCluster, error)

CreateCluster creates a cluster, optionally restored from a backup.

func (*InMemoryBackend) CreateHsm 

func (b *InMemoryBackend) CreateHsm(ctx context.Context, clusterID, zone, ip string) (wireHsm, error)

CreateHsm adds an HSM to a cluster in the given Availability Zone.

func (*InMemoryBackend) DeleteBackup 

func (b *InMemoryBackend) DeleteBackup(ctx context.Context, id string) (wireBackup, error)

DeleteBackup schedules a backup for deletion; it can be restored for seven days.

func (*InMemoryBackend) DeleteCluster 

func (b *InMemoryBackend) DeleteCluster(ctx context.Context, id string) (wireCluster, error)

DeleteCluster starts deleting a cluster that has no HSMs.

func (*InMemoryBackend) DeleteHsm 

func (b *InMemoryBackend) DeleteHsm(ctx context.Context, in DeleteHsmInput) (string, error)

DeleteHsm starts deleting an HSM and returns its ID.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(ctx context.Context, resourceARN string) (string, error)

DeleteResourcePolicy removes and returns the policy attached to a backup.

func (*InMemoryBackend) DescribeBackups 

func (b *InMemoryBackend) DescribeBackups(ctx context.Context, in DescribeBackupsInput) (page.Page[wireBackup], error)

DescribeBackups lists the caller's backups, or those shared with it.

func (*InMemoryBackend) DescribeClusters 

func (b *InMemoryBackend) DescribeClusters(
	ctx context.Context, filters map[string][]string, token string, maxResults *int32,
) (page.Page[wireCluster], error)

DescribeClusters lists the caller's clusters.

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(ctx context.Context, resourceARN string) (string, error)

GetResourcePolicy returns the policy attached to a backup.

func (*InMemoryBackend) InitializeCluster 

func (b *InMemoryBackend) InitializeCluster(
	ctx context.Context, id, signedCert, trustAnchor string,
) (string, string, error)

InitializeCluster claims a cluster with a signed certificate and trust anchor.

func (*InMemoryBackend) ListTags 

func (b *InMemoryBackend) ListTags(
	ctx context.Context, ref, token string, maxResults *int32,
) (page.Page[wireTag], error)

ListTags pages the tags of a cluster or backup.

func (*InMemoryBackend) ModifyBackupAttributes 

func (b *InMemoryBackend) ModifyBackupAttributes(
	ctx context.Context,
	id string,
	neverExpires bool,
) (wireBackup, error)

ModifyBackupAttributes exempts a backup from, or returns it to, the cluster retention policy.

func (*InMemoryBackend) ModifyCluster 

func (b *InMemoryBackend) ModifyCluster(ctx context.Context, in ModifyClusterInput) (wireCluster, error)

ModifyCluster changes the backup retention policy and/or HSM type.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(ctx context.Context, resourceARN, policy string) (string, error)

PutResourcePolicy attaches a policy to a READY backup the caller owns.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the default region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears every table.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads a snapshot; an incompatible version is discarded.

func (*InMemoryBackend) RestoreBackup 

func (b *InMemoryBackend) RestoreBackup(ctx context.Context, id string) (wireBackup, error)

RestoreBackup cancels a pending backup deletion.

func (*InMemoryBackend) SetLifecycleDelay 

func (b *InMemoryBackend) SetLifecycleDelay(d time.Duration)

SetLifecycleDelay overrides how long clusters, HSMs and backups stay in a transitional state.

func (*InMemoryBackend) SetNetwork 

func (b *InMemoryBackend) SetNetwork(n Network)

SetNetwork wires the EC2 lookups used for subnets, security groups and ENIs.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(ctx context.Context, ref string, tagList []wireTag) error

TagResource adds or replaces tags on a cluster or backup.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(ctx context.Context, ref string, keys []string) error

UntagResource removes tags by key.

type ModifyClusterInput 

type ModifyClusterInput struct {
	Retention *wireRetention
	HsmType   string
	ClusterID string
}

ModifyClusterInput holds ModifyCluster parameters.

type Network 

type Network interface {
	// SubnetInfo returns the VPC and Availability Zone of each requested subnet that exists in the region.
	SubnetInfo(region string, subnetIDs []string) map[string]Subnet
	CreateSecurityGroup(region, name, description, vpcID string) (string, error)
	DeleteSecurityGroup(region, id string)
	CreateENI(region, subnetID, ip, securityGroupID, description string) (eniID, eniIP string, err error)
	DeleteENI(region, id string)
}

Network is the VPC surface the backend needs: subnet lookup, security group and ENI management.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS CloudHSM v2.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init builds the backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Subnet 

type Subnet struct{ VpcID, Zone string }

Subnet is the EC2 view of a subnet.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.