Connects or reconnects a custom key store to its associated AWS CloudHSM cluster.
The custom key store must be connected before you can create customer master keys (CMKs) in the key store or use the CMKs it contains. You can disconnect and reconnect a custom key store at any time.
To connect a custom key store, its associated AWS CloudHSM cluster must
have at least one active HSM. To get the number of active HSMs in a
cluster, use the
DescribeClusters
operation. To add HSMs to the cluster, use the
CreateHsm
operation. Also, the kmsuser crypto user
(CU) must not be logged into the cluster. This prevents AWS KMS from
using this account to log in.
The connection process can take an extended amount of time to complete;
up to 20 minutes. This operation starts the connection process, but it
does not wait for it to complete. When it succeeds, this operation
quickly returns an HTTP 200 response and a JSON object with no
properties. However, this response does not indicate that the custom key
store is connected. To get the connection state of the custom key store,
use the describe_custom_key_stores
operation.
During the connection process, AWS KMS finds the AWS CloudHSM cluster
that is associated with the custom key store, creates the connection
infrastructure, connects to the cluster, logs into the AWS CloudHSM
client as the kmsuser CU, and rotates its password.
The connect_custom_key_store operation
might fail for various reasons. To find the reason, use the
describe_custom_key_stores operation
and see the ConnectionErrorCode in the response. For help interpreting
the ConnectionErrorCode, see CustomKeyStoresListEntry.
To fix the failure, use the
disconnect_custom_key_store
operation to disconnect the custom key store, correct the error, use the
update_custom_key_store operation if
necessary, and then use
connect_custom_key_store again.
If you are having trouble connecting or disconnecting a custom key store, see Troubleshooting a Custom Key Store in the AWS Key Management Service Developer Guide.
Cross-account use: No. You cannot perform this operation on a custom key store in a different AWS account.
Required permissions: kms:ConnectCustomKeyStore (IAM policy)
Related operations
create_custom_key_store
delete_custom_key_store
describe_custom_key_stores
disconnect_custom_key_store
update_custom_key_store
kms_connect_custom_key_store(CustomKeyStoreId)An empty list.
[required] Enter the key store ID of the custom key store that you want to connect.
To find the ID of a custom key store, use the
describe_custom_key_stores
operation.
svc$connect_custom_key_store(
CustomKeyStoreId = "string"
)