kms_create_custom_key_store: Creates a custom key store that is associated with an AWS CloudHSM cluster that you own and manage

Description

Creates a custom key store that is associated with an AWS CloudHSM cluster that you own and manage.

This operation is part of the Custom Key Store feature feature in AWS KMS, which combines the convenience and extensive integration of AWS KMS with the isolation and control of a single-tenant key store.

Before you create the custom key store, you must assemble the required elements, including an AWS CloudHSM cluster that fulfills the requirements for a custom key store. For details about the required elements, see Assemble the Prerequisites in the AWS Key Management Service Developer Guide.

When the operation completes successfully, it returns the ID of the new custom key store. Before you can use your new custom key store, you need to use the connect_custom_key_store operation to connect the new key store to its AWS CloudHSM cluster. Even if you are not going to use your custom key store immediately, you might want to connect it to verify that all settings are correct and then disconnect it until you are ready to use it.

For help with failures, see Troubleshooting a Custom Key Store in the AWS Key Management Service Developer Guide.

Cross-account use: No. You cannot perform this operation on a custom key store in a different AWS account.

Required permissions: kms:CreateCustomKeyStore (IAM policy).

Related operations:

connect_custom_key_store
delete_custom_key_store
describe_custom_key_stores
disconnect_custom_key_store
update_custom_key_store

Usage

kms_create_custom_key_store(CustomKeyStoreName, CloudHsmClusterId,
  TrustAnchorCertificate, KeyStorePassword)

Value

A list with the following syntax:

list(
  CustomKeyStoreId = "string"
)

Arguments

CustomKeyStoreName

[required] Specifies a friendly name for the custom key store. The name must be unique in your AWS account.

CloudHsmClusterId

[required] Identifies the AWS CloudHSM cluster for the custom key store. Enter the cluster ID of any active AWS CloudHSM cluster that is not already associated with a custom key store. To find the cluster ID, use the DescribeClusters operation.

TrustAnchorCertificate

[required] Enter the content of the trust anchor certificate for the cluster. This is the content of the customerCA.crt file that you created when you initialized the cluster.

KeyStorePassword

[required] Enter the password of the kmsuser crypto user (CU) account in the specified AWS CloudHSM cluster. AWS KMS logs into the cluster as this user to manage key material on your behalf.

The password must be a string of 7 to 32 characters. Its value is case sensitive.

This parameter tells AWS KMS the kmsuser account password; it does not change the password in the AWS CloudHSM cluster.

Request syntax

svc$create_custom_key_store(
  CustomKeyStoreName = "string",
  CloudHsmClusterId = "string",
  TrustAnchorCertificate = "string",
  KeyStorePassword = "string"
)