Help us shape the future of Go! Take the 2026 Go Developer Survey

cloudhsmv2

package
v1.8.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: MIT Imports: 33 Imported by: 0

README

Cloudhsmv2

Parity grade: B · SDK aws-sdk-go-v2/service/cloudhsmv2@v1.43.4 · last audited 2026-10-18 (acf0513c8)

Coverage

Metric Value
PARITY entries audited 18 (18 ok)
Feature families 3 (3 ok)
Known gaps 9
Structural gaps (can't be emulated) 3
Deferred items 0
Resource leaks clean
Known gaps
  • Certificates: AwsHardwareCertificate, HsmCertificate and ManufacturerHardwareCertificate are not emitted
  • Hsm.EniIpV6: DUALSTACK clusters get an IPv4 ENI only; no IPv6 address is allocated
  • Backups: no daily automatic backups; only the lifecycle points listed in the backups family
  • DescribeBackups Shared: only PutResourcePolicy grants are consulted; RAM resource shares are not
  • CopyBackupToRegion: same-account copies only; the destination region is a label on the stored backup, not a separate backend
  • ModifyCluster: the 7 day HsmTypeRollbackExpiration window is an assumption, the SDK does not state it
  • CloudHsmAccessDeniedException and CloudHsmServiceException: never raised; no IAM is modeled
  • ResourceGroupsTaggingAPI: cluster and backup tags are not exposed through the tagging API
  • CloudFormation: AWS::CloudHSM::Cluster and AWS::CloudHSM::HSM are not provisioned by the CloudFormation emulator
Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

  • Cluster.PreCoPassword: the HSM user model (PRECO, CO, CU) does not exist, so no password can be real
  • Certificates hardware chain: there is no physical HSM to carry AWS or manufacturer hardware certificates
  • Cluster ACTIVE from a customer activation: real clusters become ACTIVE after the CloudHSM CLI activates them on the HSM; the emulator derives ACTIVE from an initialized cluster with an ACTIVE HSM

More

Documentation

Overview

Package cloudhsmv2 emulates the AWS CloudHSM v2 control plane: clusters, HSMs and backups.

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrAccessDenied          = errors.New("access denied")
	ErrInternalFailure       = errors.New("internal failure")
	ErrInvalidRequest        = errors.New("invalid request")
	ErrResourceLimitExceeded = errors.New("resource limit exceeded")
	ErrResourceNotFound      = errors.New("resource not found")
	ErrService               = errors.New("service error")
	ErrTag                   = errors.New("invalid tag")
)

Sentinels, one per exception in the pinned SDK's error set.

Functions

This section is empty.

Types

type Backup 

type Backup struct {
	Created       time.Time         `json:"created"`
	ReadyAt       time.Time         `json:"readyAt"`
	CopyTime      time.Time         `json:"copyTime"`
	DeleteAt      time.Time         `json:"deleteAt"`
	Tags          map[string]string `json:"tags"`
	ID            string            `json:"id"`
	Account       string            `json:"account"`
	Region        string            `json:"region"`
	ClusterID     string            `json:"clusterId"`
	HsmType       string            `json:"hsmType"`
	Mode          string            `json:"mode"`
	ClusterCert   string            `json:"clusterCert,omitempty"`
	SourceBackup  string            `json:"sourceBackup,omitempty"`
	SourceCluster string            `json:"sourceCluster,omitempty"`
	SourceRegion  string            `json:"sourceRegion,omitempty"`
	Policy        string            `json:"policy,omitempty"`
	RetentionDays int               `json:"retentionDays"`
	NeverExpires  bool              `json:"neverExpires"`
}

Backup is a stored cluster backup.

type Cluster 

type Cluster struct {
	Created        time.Time         `json:"created"`
	ReadyAt        time.Time         `json:"readyAt"`
	InitUntil      time.Time         `json:"initUntil"`
	ModifyUntil    time.Time         `json:"modifyUntil"`
	RollbackExpiry time.Time         `json:"rollbackExpiry"`
	DeletedAt      time.Time         `json:"deletedAt"`
	DeleteUntil    time.Time         `json:"deleteUntil"`
	SubnetMapping  map[string]string `json:"subnetMapping"`
	Tags           map[string]string `json:"tags"`
	ID             string            `json:"id"`
	Account        string            `json:"account"`
	Region         string            `json:"region"`
	HsmType        string            `json:"hsmType"`
	Mode           string            `json:"mode"`
	NetworkType    string            `json:"networkType"`
	VpcID          string            `json:"vpcId"`
	SecurityGroup  string            `json:"securityGroup"`
	SourceBackupID string            `json:"sourceBackupId,omitempty"`
	CSR            string            `json:"csr"`
	ClusterCert    string            `json:"clusterCert,omitempty"`
	RetentionDays  int               `json:"retentionDays"`
	Initialized    bool              `json:"initialized"`
}

Cluster is a stored CloudHSM cluster.

type CreateClusterInput 

type CreateClusterInput struct {
	Retention      *wireRetention
	HsmType        string
	Mode           string
	NetworkType    string
	SourceBackupID string
	SubnetIDs      []string
	Tags           []wireTag
}

CreateClusterInput holds CreateCluster parameters.

type DeleteHsmInput 

type DeleteHsmInput struct {
	ClusterID, HsmID, EniID, EniIP string
}

DeleteHsmInput identifies the HSM to delete by one of its ID, ENI ID or ENI IP.

type DescribeBackupsInput 

type DescribeBackupsInput struct {
	Filters       map[string][]string
	MaxResults    *int32
	NextToken     string
	Shared        bool
	SortAscending bool
}

DescribeBackupsInput holds DescribeBackups parameters.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
}

Handler serves the CloudHSM v2 awsjson1.1 API.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler wraps a backend.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations lists the fault-injectable operations.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions lists the regions this handler serves.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase service name for fault rules.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name from X-Amz-Target.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource returns the operation name; the API has no single resource key.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists every routed operation.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the echo handler.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches the BaldrApiService X-Amz-Target prefix.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable.

type Hsm 

type Hsm struct {
	Created     time.Time `json:"created"`
	ReadyAt     time.Time `json:"readyAt"`
	DeletedAt   time.Time `json:"deletedAt"`
	DeleteUntil time.Time `json:"deleteUntil"`
	ID          string    `json:"id"`
	ClusterID   string    `json:"clusterId"`
	Account     string    `json:"account"`
	Region      string    `json:"region"`
	Zone        string    `json:"zone"`
	SubnetID    string    `json:"subnetId"`
	EniID       string    `json:"eniId"`
	EniIP       string    `json:"eniIp"`
	HsmType     string    `json:"hsmType"`
}

Hsm is a stored HSM.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the CloudHSM v2 state; one coarse lock guards every table.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) CopyBackupToRegion 

func (b *InMemoryBackend) CopyBackupToRegion(
	ctx context.Context, id, destRegion string, tagList []wireTag,
) (wireDestinationBackup, error)

CopyBackupToRegion copies a ready backup into another region.

func (*InMemoryBackend) CreateCluster 

func (b *InMemoryBackend) CreateCluster(ctx context.Context, in CreateClusterInput) (wireCluster, error)

CreateCluster creates a cluster, optionally restored from a backup.

func (*InMemoryBackend) CreateHsm 

func (b *InMemoryBackend) CreateHsm(ctx context.Context, clusterID, zone, ip string) (wireHsm, error)

CreateHsm adds an HSM to a cluster in the given Availability Zone.

func (*InMemoryBackend) DeleteBackup 

func (b *InMemoryBackend) DeleteBackup(ctx context.Context, id string) (wireBackup, error)

DeleteBackup schedules a backup for deletion; it can be restored for seven days.

func (*InMemoryBackend) DeleteCluster 

func (b *InMemoryBackend) DeleteCluster(ctx context.Context, id string) (wireCluster, error)

DeleteCluster starts deleting a cluster that has no HSMs.

func (*InMemoryBackend) DeleteHsm 

func (b *InMemoryBackend) DeleteHsm(ctx context.Context, in DeleteHsmInput) (string, error)

DeleteHsm starts deleting an HSM and returns its ID.

func (*InMemoryBackend) DeleteResourcePolicy 

func (b *InMemoryBackend) DeleteResourcePolicy(ctx context.Context, resourceARN string) (string, error)

DeleteResourcePolicy removes and returns the policy attached to a backup.

func (*InMemoryBackend) DescribeBackups 

func (b *InMemoryBackend) DescribeBackups(ctx context.Context, in DescribeBackupsInput) (page.Page[wireBackup], error)

DescribeBackups lists the caller's backups, or those shared with it.

func (*InMemoryBackend) DescribeClusters 

func (b *InMemoryBackend) DescribeClusters(
	ctx context.Context, filters map[string][]string, token string, maxResults *int32,
) (page.Page[wireCluster], error)

DescribeClusters lists the caller's clusters.

func (*InMemoryBackend) GetResourcePolicy 

func (b *InMemoryBackend) GetResourcePolicy(ctx context.Context, resourceARN string) (string, error)

GetResourcePolicy returns the policy attached to a backup.

func (*InMemoryBackend) InitializeCluster 

func (b *InMemoryBackend) InitializeCluster(
	ctx context.Context, id, signedCert, trustAnchor string,
) (string, string, error)

InitializeCluster claims a cluster with a signed certificate and trust anchor.

func (*InMemoryBackend) ListTags 

func (b *InMemoryBackend) ListTags(
	ctx context.Context, ref, token string, maxResults *int32,
) (page.Page[wireTag], error)

ListTags pages the tags of a cluster or backup.

func (*InMemoryBackend) ModifyBackupAttributes 

func (b *InMemoryBackend) ModifyBackupAttributes(
	ctx context.Context,
	id string,
	neverExpires bool,
) (wireBackup, error)

ModifyBackupAttributes exempts a backup from, or returns it to, the cluster retention policy.

func (*InMemoryBackend) ModifyCluster 

func (b *InMemoryBackend) ModifyCluster(ctx context.Context, in ModifyClusterInput) (wireCluster, error)

ModifyCluster changes the backup retention policy and/or HSM type.

func (*InMemoryBackend) PutResourcePolicy 

func (b *InMemoryBackend) PutResourcePolicy(ctx context.Context, resourceARN, policy string) (string, error)

PutResourcePolicy attaches a policy to a READY backup the caller owns.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the default region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears every table.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads a snapshot; an incompatible version is discarded.

func (*InMemoryBackend) RestoreBackup 

func (b *InMemoryBackend) RestoreBackup(ctx context.Context, id string) (wireBackup, error)

RestoreBackup cancels a pending backup deletion.

func (*InMemoryBackend) SetLifecycleDelay 

func (b *InMemoryBackend) SetLifecycleDelay(d time.Duration)

SetLifecycleDelay overrides how long clusters, HSMs and backups stay in a transitional state.

func (*InMemoryBackend) SetNetwork 

func (b *InMemoryBackend) SetNetwork(n Network)

SetNetwork wires the EC2 lookups used for subnets, security groups and ENIs.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state.

func (*InMemoryBackend) TagResource 

func (b *InMemoryBackend) TagResource(ctx context.Context, ref string, tagList []wireTag) error

TagResource adds or replaces tags on a cluster or backup.

func (*InMemoryBackend) UntagResource 

func (b *InMemoryBackend) UntagResource(ctx context.Context, ref string, keys []string) error

UntagResource removes tags by key.

type ModifyClusterInput 

type ModifyClusterInput struct {
	Retention *wireRetention
	HsmType   string
	ClusterID string
}

ModifyClusterInput holds ModifyCluster parameters.

type Network 

type Network interface {
	// SubnetInfo returns the VPC and Availability Zone of each requested subnet that exists in the region.
	SubnetInfo(region string, subnetIDs []string) map[string]Subnet
	CreateSecurityGroup(region, name, description, vpcID string) (string, error)
	DeleteSecurityGroup(region, id string)
	CreateENI(region, subnetID, ip, securityGroupID, description string) (eniID, eniIP string, err error)
	DeleteENI(region, id string)
}

Network is the VPC surface the backend needs: subnet lookup, security group and ENI management.

type Provider 

type Provider struct{}

Provider implements service.Provider for AWS CloudHSM v2.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init builds the backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Subnet 

type Subnet struct{ VpcID, Zone string }

Subnet is the EC2 view of a subnet.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.