Cloud Hardware Security Module (HSM) provides the data backup and restoration feature. After an accidental operation on an HSM is performed, you can use the feature to restore data to the original HSM or to another HSM to implement data replication between HSMs. This topic describes how to use the data backup and restoration feature.
Feature description
After you enable the data backup and restoration feature for an HSM, Cloud Hardware Security Module automatically backs up data of the HSM at 00:00 (UTC+8) every day. When you enable the feature, you must configure the image quota. Each backup creates one image. If the image quota is exhausted, the new image overwrites the earliest image.
Before an image is created for an HSM, Cloud Hardware Security Module compares the digest of the current data that you want to back up with the digest of the previous image. If the digests are consistent, the data has not changed. In this case, no image is created.
Backup data
Backup data | Description |
User information | Includes user account, passwords and identity type. |
Certificate information | Includes cluster certificates and self-signed certificates. |
Key | Includes key and its attributes (key identifier, key type, key usage, key status, key owner information, KCV identifier, elliptic curve type (only for ECC keys), CRT parameters (only for RSA keys). |
Hardware-protected key of KMS is a key depending on HSM, including key material and key metadata.
The key material refers to the hardware-protected keys mapped on the HSM, which can be backed up through the HSM backup feature. For more information, see Manage data backup and restoration.
The key metadata refers to information stored in KMS, such as key ID, the associated KMS instance, Alibaba Resource Name (ARN), and key policies, which does not support back up.
Billing description
If you enable the data backup and restoration feature, you are charged based on the number of images that you specify. The fee for each image is USD 8.79.
Backup deletion description
You cannot manually delete backups or images in the backups. After 90 days when an HSM is released, the backups of the HSM are automatically deleted, and all images in the backups are released. Before backups are deleted, you can perform cross-region replication or restoration.
Back up data of an HSM
If you enable the data backup and restoration feature on Day T, the system starts the first backup at 00:00 (UTC+8) on Day T+1. Subsequently, backups are performed at 00:00 every day.
When you purchase an HSM, you can enable the data backup and restoration feature. Backups are automatically performed based on the scheduled time. For more information, see Purchase and enable an HSM. The following section describes how to enable the data backup and restoration feature for an existing HSM.
Log on to the Cloud Hardware Security Module console. In the top navigation bar, select the required region.
On the Instances page, find the HSM for which you want to enable the feature and choose
> Upgrade in the Actions column. NoteIf you cannot view the Upgrade option, the backup and restoration feature is enabled for the HSM.
On the Upgrade/Downgrade page, select Enable for Data Backup and Restoration, configure Image Quota, read and select Terms of Service, and then click Buy Now. Then, follow the on-screen instructions to complete the payment.
After you enable the backup and restoration feature, you can view the name of the backup on the Data Backup and Restoration page.
Intra-region data restoration
Intra-region data restoration supports the following operations:
Restore data to the original HSM: Disable the HSM and restore data to the original HSM by using an image.
Create a duplicate HSM: Purchase an HSM and restore data to the new HSM by using an image. In the following example, this operation is used.
The new HSM must meet the following conditions:
The HSM resides in the same region as the backup.
The HSM is not added to a cluster.
The HSM is in the New or Disabled status.
The HSM is not initialized.
The HSM is of the same type as the HSM whose data you want to restore.
Log on to the Cloud Hardware Security Module console. In the top navigation bar, select the required region.
Purchase an HSM. For more information, see Purchase and enable an HSM.
ImportantDo not enable the HSM.
On the Data Backup and Restoration page, find the backup that you want to manage and click View Image in the Actions column.
Find the ID of the image whose data you want to restore and click Restore Instance in the Actions column.
In the Restore Instance dialog box, configure Instance and click OK.
After you perform data restoration, the data in the image is replicated to the new HSM.
Cross-region image replication
You can perform cross-region image replication in regions outside the Chinese mainland. After you replicate an image of an HSM, you can use the image to create a duplicate HSM in the destination region. For example, you can replicate an image from the Singapore region to the Malaysia (Kuala Lumpur) region. In this case, a backup whose Backup Type is Cross-region Replication is automatically created in the Malaysia (Kuala Lumpur) region.
All images that are replicated from other regions are aggregated to this backup. The backup does not expire.
Log on to the Cloud Hardware Security Module console. In the top navigation bar, select the required region.
On the Data Backup and Restoration page, find the backup that you want to manage and click View Image in the Actions column.
Find the ID of the image whose data you want to replicate and click Cross-region Copy in the Actions column.
In the Copy Image dialog box, configure Destination Region and click OK.
Switch to the destination region and view the image on the Data Backup and Restoration page.
Find the backup whose Backup Type is Cross-region Copy and click View Image in the Actions column.
NoteThe backup contains all images from other regions.
View the replicated image based on the image replication time.
Move the pointer over the
icon next to the image ID to view the original backup ID, original image ID, original instance ID, and original image region.
Cross-region data restoration
After you replicate an image across regions, you can purchase an HSM in the destination region and restore data to the HSM by using the image. This way, a duplicate HSM is created.
The new HSM must meet the following conditions:
The HSM resides in the same region as the backup.
The HSM is not added to a cluster.
The HSM is in the New or Disabled status.
The HSM is not initialized.
The HSM is of the same type as the HSM whose data you want to restore.
Log on to the Cloud Hardware Security Module console. In the top navigation bar, select the required region.
Purchase an HSM. For more information, see Purchase and enable an HSM.
ImportantDo not enable the HSM.
On the Data Backup and Restoration page, find the backup whose Backup Type is Cross-region Copy and click View Image in the Actions column.
Find the ID of the image whose data you want to restore and click Restore Instance in the Actions column.
In the Restore Instance dialog box, configure Instance and click OK.
After you perform data restoration, the data in the image is replicated to the new HSM.