AmazonKeyManagementServiceClient.CreateCustomKeyStore (CreateCustomKeyStoreRequest)

This example creates a custom key store that is associated with an AWS CloudHSM cluster.

To create an AWS CloudHSM key store

var client = new AmazonKeyManagementServiceClient();
var response = client.CreateCustomKeyStore(new CreateCustomKeyStoreRequest 
{
    CloudHsmClusterId = "cluster-234abcdefABC", // The ID of the CloudHSM cluster.
    CustomKeyStoreName = "ExampleKeyStore", // A friendly name for the custom key store.
    KeyStorePassword = "kmsPswd", // The password for the kmsuser CU account in the specified cluster.
    TrustAnchorCertificate = "<certificate-goes-here>" // The content of the customerCA.crt file that you created when you initialized the cluster.
});

string customKeyStoreId = response.CustomKeyStoreId; // The ID of the new custom key store.

            

This example creates an external key store that uses an Amazon VPC endpoint service to communicate with AWS KMS.

To create an external key store with VPC endpoint service connectivity

var client = new AmazonKeyManagementServiceClient();
var response = client.CreateCustomKeyStore(new CreateCustomKeyStoreRequest 
{
    CustomKeyStoreName = "ExampleVPCEndpointKeyStore", // A friendly name for the custom key store
    CustomKeyStoreType = "EXTERNAL_KEY_STORE", // For external key stores, the value must be EXTERNAL_KEY_STORE
    XksProxyAuthenticationCredential = new XksProxyAuthenticationCredentialType {
        AccessKeyId = "ABCDE12345670EXAMPLE",
        RawSecretAccessKey = "DXjSUawnel2fr6SKC7G25CNxTyWKE5PF9XX6H/u9pSo="
    }, // The access key ID and secret access key that KMS uses to authenticate to your external key store proxy
    XksProxyConnectivity = "VPC_ENDPOINT_SERVICE", // Indicates how AWS KMS communicates with the external key store proxy
    XksProxyUriEndpoint = "https://myproxy-private.xks.example.com", // The URI that AWS KMS uses to connect to the external key store proxy
    XksProxyUriPath = "/example-prefix/kms/xks/v1", // The URI path to the external key store proxy APIs
    XksProxyVpcEndpointServiceName = "com.amazonaws.vpce.us-east-1.vpce-svc-example1" // The VPC endpoint service that KMS uses to communicate with the external key store proxy
});

string customKeyStoreId = response.CustomKeyStoreId; // The ID of the new custom key store.

            

This example creates an external key store with public endpoint connectivity.

To create an external key store with public endpoint connectivity

var client = new AmazonKeyManagementServiceClient();
var response = client.CreateCustomKeyStore(new CreateCustomKeyStoreRequest 
{
    CustomKeyStoreName = "ExamplePublicEndpointKeyStore", // A friendly name for the custom key store
    CustomKeyStoreType = "EXTERNAL_KEY_STORE", // For external key stores, the value must be EXTERNAL_KEY_STORE
    XksProxyAuthenticationCredential = new XksProxyAuthenticationCredentialType {
        AccessKeyId = "ABCDE12345670EXAMPLE",
        RawSecretAccessKey = "DXjSUawnel2fr6SKC7G25CNxTyWKE5PF9XX6H/u9pSo="
    }, // The access key ID and secret access key that KMS uses to authenticate to your external key store proxy
    XksProxyConnectivity = "PUBLIC_ENDPOINT", // Indicates how AWS KMS communicates with the external key store proxy
    XksProxyUriEndpoint = "https://myproxy.xks.example.com", // The URI that AWS KMS uses to connect to the external key store proxy
    XksProxyUriPath = "/kms/xks/v1" // The URI path to your external key store proxy API
});

string customKeyStoreId = response.CustomKeyStoreId; // The ID of the new custom key store.