You can use the data backup and restoration feature to restore an HSM to a previous data state or replicate its data to another HSM in the same or a different region. This is useful for data recovery or deploying services across multiple regions.
Features
Each backup operation performs a full backup of the HSM data and generates an image. If you use an existing image to perform a new backup, the data in that image is overwritten. You can enable data backup and restoration for all HSMs in a cluster, or you can back up a single HSM instance.
Backup content
Backup data | Description |
User information | User accounts, passwords, and identity types. |
Certificate information | Cluster certificates and self-signed certificates. |
keys | Keys and their attributes, such as key identifiers, key types, key usage, key status, owner information, Key Check Value (KCV) identifiers, elliptic curve types (for ECC keys only), and CRT parameters (for RSA keys only). |
A hardware-protected key from KMS is a type of key that relies on an HSM. It contains both key material (the HSM-managed key) and key metadata. The HSM can back up the key material, but not the key metadata.
Key material consists of the core cryptographic parameters generated and managed by KMS within the physically isolated HSM environment.
Key metadata includes business-related information stored in KMS, such as the key ID, the associated KMS instance, ARN, and key policy.
Backup method and schedule
Only full backups are supported. Incremental backups are not supported.
If you enable the data backup and restoration feature on Day T, the system performs the first backup at 00:00 (UTC+8) on Day T+1. Subsequent backups are performed daily at 00:00 (UTC+8). Each backup generates an image. If the image quota is reached, the newly generated image overwrites the oldest one.
Backups cannot be downloaded or deleted
Backups and their images cannot be downloaded, and you cannot view the detailed data within an image. This design reduces the risk of unauthorized data copying or data breaches.
You cannot manually delete backups or their images. Backups and all their image data are automatically deleted 90 days after the associated HSM instance is released. Before a backup is deleted, you can still perform cross-region copy or instance restore operations.
Operation audit
All backup and restoration operations are recorded and can be queried in ActionTrail.
Billing
When you enable the data backup and restoration feature for an HSM instance, you are charged based on the number of images you select. Each image costs USD 10.
Backup and restoration workflows
Use case 1: Restore all HSMs in a cluster
To restore the data of an HSM cluster, you must first remove all HSMs from the cluster, then recreate the HSMs from an image and redeploy the cluster. This process deletes all data in the cluster. The following workflow is for reference only. We recommend contacting technical support before you perform this operation.
Use case 2: Replicate data to a cross-region cluster
The following workflow outlines the process. Because HSMs require a dual-availability zone deployment, you must purchase at least two HSMs in Region B. After purchase, do not enable or initialize the HSMs.
Procedure
Back up HSM data
Before you back up data, ensure the status of the HSM instance is Enabled.
You can enable data backup and restoration when you purchase an HSM instance. In this case, because HSMs require a cluster deployment, you must purchase at least two HSMs across two availability zones. This method enables data backup and restoration for all purchased HSMs. Alternatively, you can enable the feature for a single HSM later if you did not enable it at the time of purchase.
Method 1: Enable data backup and restoration when purchasing an HSM instance.
For more information, see Purchase an HSM instance. After the purchase is successful, backups are created automatically on schedule. You can view the backups on the Data Backup and Restoration page.
Method 2: Enable the data backup and restoration feature for an existing HSM instance.
Go to the Virtual HSM Instances page of the CloudHSM console. In the top navigation bar, select the destination region.
Find the target HSM and, in the Actions column, click .
NoteIf the Upgrade option is not available, the data backup and restoration feature may already be enabled for this HSM.
On the Upgrade page, enable data backup and restoration, select the number of images, read and select the terms of service, and then click Buy Now. Follow the prompts to complete the payment.
After the purchase is successful, backups are created automatically on schedule. You can see the name of the generated backup on the Data Backup and Restoration page.
Copy an image across regions
You can copy images only between regions in the Chinese mainland. After you copy an image, a new backup with the Backup Type of Cross-region Copy is automatically created in the destination region. This new backup contains the copied image. For example, you can copy an image from the China (Hangzhou) region to the China (Shanghai) region.
Go to the Data Backup and Restore Management page of the CloudHSM console. In the top navigation bar, select the destination region.
Find the target backup and click View Image in the Actions column.
Find the target Image ID and click Cross-region Copy in the Actions column.
In the Copy Image dialog box, select a Destination Region and click OK.
Switch to the destination region and view the image on the Data Backup and Restoration page.
Find the backup whose Backup Type is Cross-region Copy and click View Image in the Actions column.
NoteThis backup contains all images that have been copied from other regions and does not expire.
Find the copied image based on its creation time.
Hover over the
icon next to the image ID to view the original backup ID, original image ID, original instance ID, and original region.
Restore HSM data from an image
Using an image, you can either restore an HSM's original data or create a new, identical HSM.
The destination HSM must meet the following prerequisites:
The HSM instance must be in the same region as the backup. For a cross-region restoration, you must first copy the image to the destination region.
The HSM instance must be of the same type as the source HSM.
The HSM is not part of a cluster.
The HSM status is Not Enabled or Stopped.
The HSM has not been initialized.
Prepare an HSM instance.
If no HSM instance is available in the destination region, purchase one first. For more information, see Purchase an HSM instance.
ImportantDo not enable the HSM instance after purchase.
If the destination HSM is already in use, contact Alibaba Cloud technical support to stop and reset the instance.
Find the target image.
Go to the Data Backup and Restore Management page of the CloudHSM console. In the top navigation bar, select the destination region.
On the Data Backup and Restoration page, find the target image.
For same-region restoration: Find the target backup and click View Image in the Actions column.
For cross-region restoration: Find the backup whose Backup Type is Cross-region Copy and click View Image in the Actions column.
Locate the target Image ID and click Restore Instance in the Actions column.
In the Restore Instance dialog box, select a Instance and click OK.
After the restoration is successful, the data from the image is copied to the destination HSM.