IBM & Red Hat on AWS
IBM Guardium Cryptography Manager is now on AWS Marketplace
When you distribute workloads across multiple teams, AWS accounts, AWS Regions, and on-premises environments, cryptographic assets follow that structure. Keys, certificates, secrets, and algorithms accumulate wherever teams build, and the details of each asset, including its owner, expiration date, and rotation schedule, tend to stay with the team that created them.
With a unified system of record, you can catch certificate expirations early, keep algorithms current, and keep every asset within approved governance processes. As you plan your migration to post-quantum cryptography, cryptographic visibility has direct operational value.
IBM Guardium Cryptography Manager (GCM) gives you a central inventory of your cryptographic assets, along with governance capabilities to manage them across your AWS and on-premises environments. It is now available on AWS Marketplace, so you can evaluate and deploy it in your own AWS account.
Deploy through AWS Marketplace automation
You can deploy IBM Guardium Cryptography Manager from AWS Marketplace, onto Amazon Elastic Kubernetes Service (Amazon EKS) using an AWS CloudFormation template. The template provisions the required resources, reducing manual configuration steps. You can choose to create a new Amazon EKS cluster or deploy the solution into an existing one.
Evaluate for 90 days, then move to production
Every deployment of GCM through AWS Marketplace includes a 90-day trial. During this period, your security, compliance, and operations teams can run an evaluation against your workloads running on AWS, using your own data and configuration.
When the trial period ends, your deployment moves to production through a Bring Your Own License (BYOL) arrangement. You apply a valid GCM license from IBM to the instance that is already running, so you don’t need to rebuild or redeploy it. You can align this license with your existing IBM agreements. AWS charges for the underlying services apply throughout the trial and production periods.
Turn cryptographic discovery into action
After you deploy GCM, it discovers cryptographic assets across your connected AWS accounts and Regions. Your security and compliance teams can then do the following:
- Build a complete inventory of keys, certificates, secrets, and algorithms in use
- Identify expired or expiring certificates and flag keys not rotating on schedule
- Detect weak, deprecated, or non-compliant algorithms
- Uncover shadow (unmanaged or undocumented) cryptographic assets operating outside governance controls
- Score and prioritize risk as shown in Figure 1, then trigger remediation through configurable, policy-driven workflows
Figure 1. Manage risk score from a central point of view.
- Generate centralized audit reports that support compliance requirements
As shown in Figure 2, this inventory becomes the operational foundation for day-to-day cryptographic hygiene, and longer-horizon planning around crypto-agility and quantum-safe readiness.
Figure 2. Manage all your cryptographic inventory in one place.
Integration with AWS services
IBM Guardium Cryptography Manager integrates with AWS services, including AWS CloudFormation, Amazon EKS, Amazon Elastic Compute Cloud (Amazon EC2), AWS Identity and Access Management (IAM), and Amazon Simple Storage Service (Amazon S3). Discovery works across multi-account and multi-Region architectures, so your cryptographic visibility keeps pace with distributed AWS deployments.
A starting point for quantum-safe planning
Crypto-agility is the ability to update cryptographic mechanisms quickly as requirements shift, and it depends on knowing what you have. GCM creates that baseline. With a current inventory of your cryptographic assets and a view of where vulnerabilities exist, you can move from reactive incident response to migration planning, including preparation for post-quantum cryptographic standards. You can get a view of exploitable cryptographic objects and act as shown in Figure 3.
Figure 3. View of organization wide exploitable cryptographic objects to take action on.
Conclusion
In this post, you learned how to deploy IBM Guardium Cryptography Manager from AWS Marketplace. You saw how you can deploy it with an AWS CloudFormation template, evaluate it for 90 days, and build cryptographic visibility across your AWS environment.
Call to Action
To get started, visit IBM Guardium Cryptography Manager on AWS Marketplace. Contact your AWS or IBM account team to learn how you can discover, monitor, and secure your cryptographic infrastructure for compliance and quantum readiness.