Question

A financial services company must inspect all outbound TLS traffic from a centralized inspection VPC using third-party firewall appliances behind a Gateway Load Balancer. A compliance mandate requires that the private keys used for TLS decryption never be exportable in plaintext and that all cryptographic operations be performed on FIPS 140-2 Level 3 validated hardware under the company's sole control. The security team wants to minimize custom key-handling code on the appliances. Which approach BEST satisfies these requirements?

Accepted Answer

Configure the firewall appliances to use keys stored in an AWS CloudHSM cluster, integrating via the PKCS#11 library so private key operations occur inside the FIPS 140-2 Level 3 HSMs

Answer

Store the TLS private keys as encrypted secrets in AWS Secrets Manager and have each appliance decrypt them at boot using an AWS KMS customer managed key

Answer

Use AWS Certificate Manager to issue the decryption certificates and attach them directly to the Gateway Load Balancer for inline TLS termination

Answer

Enable AWS Network Firewall TLS inspection with a KMS customer managed key and route the inspection VPC traffic through it instead of the appliances