Create an AWS CloudHSM user with CloudHSM CLI - AWS CloudHSM
User typeRequirementsSyntaxExampleArgumentsRelated topics

Create an AWS CloudHSM user with CloudHSM CLI

The user create command in CloudHSM CLI creates a user in your AWS CloudHSM cluster. Only user accounts with the admin role can run this command.

User type

The following types of users can run this command.

  • Admin

Requirements

To run this command, you must be logged in as an admin user

Syntax

aws-cloudhsm > help user create
Create a new user

Usage: cloudhsm-cli user create [OPTIONS] --username <USERNAME> --role <ROLE> [--password <PASSWORD>]

Options:
      --cluster-id <CLUSTER_ID>
          Unique Id to choose which of the clusters in the config file to run the operation against. If not provided, will fall back to the value provided when interactive mode was started, or error

      --username <USERNAME>
          Username to access the HSM cluster

      --role <ROLE>
          Role the user has in the cluster

          Possible values:
          - crypto-user: A CryptoUser has the ability to manage and use keys
          - admin:       An Admin has the ability to manage user accounts

      --password <PASSWORD>
          Optional: Plaintext user's password. If you do not include this argument you will be prompted for it

      --approval <APPROVAL>
          Filepath of signed quorum token file to approve operation

  -h, --help
          Print help (see a summary with '-h')

Example

These examples show how to use user create to create new users in your HSMs.

Example : Create a crypto user

This example creates an account in your AWS CloudHSM cluster with the crypto user role.

aws-cloudhsm > user create --username alice --role crypto-user
Enter password:
Confirm password:
{
  "error_code": 0,
  "data": {
    "username": "alice",
    "role": "crypto-user"
  }
}

Arguments

<CLUSTER_ID>

The ID of the cluster to run this operation on.

Required: If multiple clusters have been configured.

<USERNAME>

Specifies a friendly name for the user. The maximum length is 31 characters. The only special character permitted is an underscore ( _ ). The username is not case sensitive in this command, username is always displayed in lowercase.

Required: Yes

<ROLE>

Specifies the role assigned to this user. This parameter is required. Valid values are admin, crypto-user.

To get the user’s role, use the user list command. For detailed information about the user types on an HSM, see Understanding HSM users.

<PASSWORD>

Specifies the password of the user who is logging in to the HSMs. The following characters are not permitted ':'

Required: Yes

<APPROVAL>

Specifies the file path to a signed quorum token file to approve operation. Only required if quorum user service quorum value is greater than 1.

Related topics