All Products
Search

This Product

    Key Management Service:Data backup and restoration for HSMs outside the Chinese mainland

    Document Center

    Key Management Service:Data backup and restoration for HSMs outside the Chinese mainland

    Last Updated:Jun 20, 2026

    The data backup and restoration feature allows you to restore an HSM instance to a previous state or restore its data to another HSM instance in the same or a different region. This is useful for data recovery and cross-region service deployment.

    Overview

    Each backup operation creates a full image of the data on an HSM instance. HSM allows you to enable data backup and restoration for all HSM instances in a cluster or for a single HSM instance.

    What is backed up

    Backup data

    Description

    User information

    User account passwords and identity types.

    Certificate information

    Cluster certificates and self-signed certificates.

    Keys

    Keys and their attributes, including the key identifier, key type, key purpose, key status, key owner information, KCV identifier, elliptic curve type (for ECC keys only), and CRT parameters (for RSA keys only).
    Note

    A KMS customer master key (CMK) is a key that depends on an HSM. It consists of key material (HSM keys) and key metadata. An HSM can back up the key material of hardware-protected keys, but not their key metadata.

    • Key material refers to the core parameters of a key that are generated and hosted by KMS in the physically isolated environment of an HSM.

    • Key metadata refers to business data stored in KMS, such as the key ID, the KMS instance to which the key belongs, the ARN, and the key policy.

    Backup method and schedule

    Only full backups are supported. Incremental backups are not supported.

    If you enable the data backup and restoration feature on day T, the first backup is created at 00:00 (UTC+8) on day T+1. Subsequent backups are created daily at 00:00 (UTC+8). Each backup operation generates one image. If all available images are used, the newly generated image overwrites the oldest one.

    Note

    Before an image is generated, the HSM compares the digest of the current HSM data with the digest of the previous image. If the digests are identical, it indicates that the HSM data has not changed. In this case, a new image is not generated to conserve your image quota.

    Download and deletion restrictions

    Backups and their images cannot be downloaded or inspected in detail. This reduces the risk of unauthorized data replication or leakage.

    Backups and their images cannot be manually deleted. Backups are automatically deleted 90 days after the HSM instance is released, which also releases all associated image data. Before a backup is deleted, you can still perform cross-region copy and instance restoration operations.

    Auditing

    Backup and restoration operations can be queried in ActionTrail.

    Billing

    You are charged for the data backup feature based on the number of images you select. Each image costs 10 USD.

    Backup and restoration workflow

    Scenario 1: Restore an entire HSM cluster

    To restore the data of HSM instances in a cluster, you must first remove all HSM instances from the cluster, then use an image to restore data to the HSM instances before re-creating the cluster. This process deletes all data in the cluster. The following workflow is for reference only. We recommend that you contact technical support before you proceed.

    Scenario 2: Replicate data to a cross-region cluster

    The overall workflow is as follows. Note that when you purchase HSM instances in Region B, you must purchase at least two instances because HSM supports only dual-zone deployment. After the purchase, you do not need to enable or initialize the HSM instances.

    Procedure

    Back up instance data

    Before you back up data, make sure the HSM instance is in the Enabled state.

    You can enable data backup and restoration when you purchase an HSM instance. In this case, you must select at least two HSM instances in two different zones because HSM supports only cluster deployments. This enables the data backup and restoration feature for all HSM instances. Alternatively, you can purchase an instance without this feature and enable it for a single HSM instance later.

    • Method 1: Enable data backup and restoration when you purchase an HSM instance.

      For more information, see Purchase an HSM instance. After the instance is enabled, the system automatically backs up data at scheduled times. You can view the backups on the Data Backup and Restoration page.

    • Method 2: Enable data backup and restoration for an existing HSM instance.

      1. Go to the Virtual HSM Instances page of the CloudHSM console. In the top navigation bar, select the destination region.

      2. Locate the target HSM instance and in the Actions column, click Upgrade.

        Note

        If Upgrade is not available, the data backup and restoration feature may already be enabled for the HSM instance.

      3. On the Upgrade/Downgrade page, enable data backup and restoration, select the number of images, read and select the terms of service, and then click Buy Now. Follow the instructions to complete the purchase.

        After the purchase is complete, the system automatically backs up data at scheduled times and you can see the names of the generated backups on the Data Backup and Restoration page. On the Data Backup and Restoration Management page, you can also view backup records. These records include details such as the backup name, backup type, backup object, number of images, and deletion time. Click View Image to view the details of the images associated with the backup.

    Cross-region image copy

    You can copy images only between regions outside the Chinese mainland. After the copy is complete, a backup with the Backup Type set to Cross-region Copy is automatically created in the destination region. The copied image is stored in this new backup. For example, you can copy an image from the Singapore region to the Malaysia (Kuala Lumpur) region.

    1. Go to the Data Backup and Restore Management page of the CloudHSM console. In the top navigation bar, select the destination region.

    2. Find the target backup and click View Image in the Actions column.

    3. Locate the target Image ID and click Cross-region Copy in the Actions column.

    4. In the Copy Image dialog box, select a Destination Region and click OK.

    5. Switch to the destination region and view the image on the Data Backup and Restoration page.

      1. Find the backup with the Backup Type set to Cross-region Copy and click View Image in the Actions column.

        Note

        This backup aggregates all images copied from other regions and has no expiration time.

      2. Find the copied image based on the copy time.

        Hover over the image icon next to the image ID to view the source backup ID, source image ID, source instance ID, and source image region.

    Restore an instance from an image

    HSM supports restoring data to an HSM instance in the same region or a different region. By restoring from an image, you can recover the original data of an HSM instance or populate a new HSM instance with the same data.

    Important

    The target HSM instance must meet the following conditions:

    • The HSM instance is in the same region as the backup. For cross-region restoration, you must first copy the image to the destination region.

    • The HSM instance type matches the source HSM instance type.

    • The HSM instance is not in a cluster.

    • The HSM instance is in the Not Enabled or Disabled state.

    • The HSM instance is not initialized.

    1. Prepare an HSM instance.

      • If no HSM instance exists in the destination region, purchase one first. For more information, see Purchase an HSM instance.

        Important

        Do not enable the HSM instance after purchase.

      • If the target HSM instance is in use, contact Alibaba Cloud technical support to disable and reset it.

    2. Find the target image.

      1. Go to the Data Backup and Restore Management page of the CloudHSM console. In the top navigation bar, select the destination region.

      2. On the Data Backup and Restoration page, find the target image.

        • Same-region restoration: Find the backup with the Backup Type set to Auto Create, and click View Image in the Actions column of the target backup.

        • Cross-region restoration: Find the backup with the Backup Type set to Cross-region Copy, and click View Image in the Actions column.

    3. Locate the target Image ID and click Restore Instance in the Actions column.

    4. In the Restore Instance dialog box, select the target Instance and click OK.

      After the restoration is successful, the data from the image is copied to the target HSM instance.