How Karrot built a large-scale signing key management system with AWS CloudHSM – Part 2: CloudHSM architecture and multi-layer access control | Amazon Web Services

Danggeun built an AWS CloudHSM-based JWT signing system on EKS and restricted CloudHSM access with dedicated node groups and security groups.

Istio AuthorizationPolicy and mTLS were used to control workload and client authentication, while certificates were auto-renewed by a CronJob and stored in Secrets Manager.

At the application layer, permissions were separated for HSM operators, developers, and the signing-only app, and Kyverno blocked token theft and scheduling to specific node groups.

Inside the HSM, key export and arbitrary deletion were prevented, with read-only users separated from key ownership privileges.

The case shows a practical way to combine Zero Trust, least privilege, automated certificate handling, and Kubernetes policy controls for large-scale signing systems.