使用 Cloud 變更使用者的MFA設定HSM CLI

使用 CloudHSM 中的 user change-mfa token-sign命令CLI來更新使用者帳戶的多重要素驗證 （MFA） 設定。任何使用者帳戶均可執行此命令。具有管理員角色的帳戶可以為其他使用者執行此命令。

使用者類型

下列使用者可以執行此命令。

語法

目前，只有一個多重要素策略供使用者使用：字符簽署。

aws-cloudhsm > help user change-mfa
Change a user's Mfa Strategy

Usage:
    user change-mfa <COMMAND>
  
Commands:
  token-sign  Register or Deregister a public key using token-sign mfa strategy
  help        Print this message or the help of the given subcommand(s)
    

Token Sign 策略需要一個權杖檔案將未簽署的權杖寫入其中。

aws-cloudhsm > help user change-mfa token-sign
Register or Deregister a public key using token-sign mfa strategy

Usage: user change-mfa token-sign [OPTIONS] --username <USERNAME> --role <ROLE> <--token <TOKEN>|--deregister>

Options:
      --cluster-id <CLUSTER_ID>
          Unique Id to choose which of the clusters in the config file to run the operation against. If not provided, will fall back to the value provided when interactive mode was started, or error

      --username <USERNAME>
          Username of the user that will be modified

      --role <ROLE>
          Role the user has in the cluster

          Possible values:
          - crypto-user: A CryptoUser has the ability to manage and use keys
          - admin:       An Admin has the ability to manage user accounts

      --change-password <CHANGE_PASSWORD>
          Optional: Plaintext user's password. If you do not include this argument you will be prompted for it

      --token <TOKEN>
          Filepath where the unsigned token file will be written. Required for enabling MFA for a user

      --approval <APPROVAL>
          Filepath of signed quorum token file to approve operation

      --deregister
          Deregister the MFA public key, if present

      --change-quorum
          Change the Quorum public key along with the MFA key

  -h, --help
          Print help (see a summary with '-h')

範例

此命令會將叢集HSM中的每個 一個未簽章權杖寫入 指定的檔案token。當系統提示您時，請在檔案中簽署權杖。

aws-cloudhsm > user change-mfa token-sign --username cu1 --change-password password --role crypto-user --token /path/myfile
Enter signed token file path (press enter if same as the unsigned token file):
Enter public key PEM file path:/path/mypemfile
{
  "error_code": 0,
  "data": {
    "username": "test_user",
    "role": "admin"
  }
}

引數

相關主題