Cryptographic material distribution and management

A system comprising:

• one or more processors;
• and
• memory storing executable instructions that, as a result of being executed by the one or more processors, cause the system to:
• in response to obtaining cryptographic material at a first domain of the system associated with a first set of permissions that includes access to hardware of the system, provision a secure module for a computing resource for which the cryptographic material is to be made available, where the computing resource is associated with a second set of permissions lacking permission to at least a portion of the hardware of the system;
• and
• allow the computing resource to access the secure module by at least providing the computing resource with programmatic access, via an interface, to the secure module, where the computing resource requests performance of cryptographic operations using the cryptographic material by the secure module by at least submitting a programmatic request to the secure module and the programmatic request lacks an ability to export the cryptographic material from the secure module to the computing resource.

A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

• obtain, at a first domain associated with a first set of privileges that includes access to hardware of the computer system, a command to provide cryptographic material to a computing resource within a second domain of the computer system and associated with a second of set privileges, the command obtained from a cryptographic material management service of a computing resource service provider;
• provision a secure module within the first domain such that the computing resource has access to the secure module through an interface, the computing resource providing requests to the secure module through the interface to perform cryptographic operations while preventing the computing resource from obtaining the cryptographic material from the secure module;
• and
• provide the cryptographic material to the secure module.