A hardware security module (HSM) is a specialized, tamper-resistant device that protects cryptographic keys and performs security-sensitive cryptographic operations. Credential management services typically use HSMs to provide stronger protection for application secrets than ordinary storage alone. section 2.2 section 2.4
Use HSM support as part of a centralized credential-management pattern:
- Store sensitive values such as passwords, API keys, and certificates in a credential service rather than configuration files. section 2.2
- Rely on the service’s HSM-backed protection instead of building a custom credential service, whose security failures could be catastrophic. section 2.2
- Pair protected storage with rotation and audit capabilities so credentials can be updated and suspicious activity investigated. section 2.2
Application credentials
An application needing passwords or API keys can obtain them from a centralized credential service; that service may use an HSM to protect its secrets. section 2.2
