Reference for CloudHSM CLI commands

CloudHSM CLI helps admins manage users in their AWS CloudHSM cluster. CloudHSM CLI can be run in two modes: Interactive Mode and Single Command Mode. For a quick start, see Getting started with CloudHSM Command Line Interface (CLI).

To run most CloudHSM CLI commands, you must start the CloudHSM CLI and log in to the HSM. If you add or delete HSMs, update the configuration files for CloudHSM CLI. Otherwise, the changes that you make might not be effective for all HSMs in the cluster.

The following topics describe commands in CloudHSM CLI:

Command	Description	User Type
cluster activate	Activates an CloudHSM cluster and provides confirmation the cluster is new. This must be done before any other operations can be performed.	Unactivated admin
cluster hsm-info	List the HSMs in your cluster.	All 1, including unauthenticated users. Login is not required.
crypto sign ecdsa	Generates a signature using an EC private key and the ECDSA signing mechanism.	Crypto users (CU)
crypto sign rsa-pkcs	Generates a signature using an RSA private key and the RSA-PKCS signing mechanism.	CU
crypto sign rsa-pkcs-pss	Generates a signature using an RSA private key and the RSA-PKCS-PSS signing mechanism.	CU
crypto verify ecdsa	Confirms a file has been signed in the HSM by a given public key. Verifies the signature was generated using the ECDSA signing mechanism. Compares a signed file against a source file and determine whether the two are cryptographically related based on a given ecdsa public key and signing mechanism.	CU
crypto verify rsa-pkcs	Confirms a file has been signed in the HSM by a given public key. Verifies the signature was generated using the RSA-PKCS signing mechanism. Compares a signed file against a source file and determines whether the two are cryptographically related based on a given rsa public key and signing mechanism.	CU
crypto verify rsa-pkcs-pss	Confirms a file has been signed in the HSM by a given public key. Verifies the signature was generated using the RSA-PKCS-PSS signing mechanism. Compares a signed file against a source file and determines whether the two are cryptographically related based on a given rsa public key and signing mechanism.	CU
key delete	Deletes a key from your AWS CloudHSM cluster.	CU
key generate-file	Generates a key file in your AWS CloudHSM cluster.	CU
key generate-asymmetric-pair rsa	Generates an asymmetric RSA key pair in your AWS CloudHSM cluster.	CU
key generate-asymmetric-pair ec	Generates an asymmetric Elliptic-curve (EC) key pair in your AWS CloudHSM cluster.	CU
key generate-symmetric aes	Generates a symmetric AES key in your AWS CloudHSM cluster.	CU
key generate-symmetric generic-secret	Generates a symmetric Generic Secret key in your AWS CloudHSM cluster.	CU
key import pem	Imports a PEM format key into an HSM. You can use it to import public keys that were generated outside of the HSM.	CU
key list	Finds all keys for the current user present in your AWS CloudHSM cluster.	CU
key replicate	Replicate a key from a source cluster to a cloned destination cluster.	CU
key set-attribute	Sets the attributes of keys in your AWS CloudHSM cluster.	CUs can run this command, admins can set the trusted attribute.
key share	Shares a key with other CUs in your AWS CloudHSM cluster.	CU
key unshare	Unshares a key with other CUs in your AWS CloudHSM cluster.	CU
key unwrap aes-gcm	Unwraps a payload key into the cluster using the AES wrapping key and the AES-GCM unwrapping mechanism.	CU
key unwrap aes-no-pad	Unwraps a payload key into the cluster using the AES wrapping key and the AES-NO-PAD unwrapping mechanism.	CU
key unwrap aes-pkcs5-pad	Unwraps a payload key using the AES wrapping key and the AES-PKCS5-PAD unwrapping mechanism.	CU
key unwrap aes-zero-pad	Unwraps a payload key into the cluster using the AES wrapping key and the AES-ZERO-PAD unwrapping mechanism.	CU
key unwrap cloudhsm-aes-gcm	Unwraps a payload key into the cluster using the AES wrapping key and the CLOUDHSM-AES-GCM unwrapping mechanism.	CU
key unwrap rsa-aes	Unwraps a payload key using an RSA private key and the RSA-AES unwrapping mechanism.	CU
key unwrap rsa-oaep	Unwraps a payload key using the RSA private key and the RSA-OAEP unwrapping mechanism.	CU
key unwrap rsa-pkcs	Unwraps a payload key using the RSA private key and the RSA-PKCS unwrapping mechanism.	CU
key wrap aes-gcm	Wraps a payload key using an AES key on the HSM and the AES-GCM wrapping mechanism.	CU
key wrap aes-no-pad	Wraps a payload key using an AES key on the HSM and the AES-NO-PAD wrapping mechanism.	CU
key wrap aes-pkcs5-pad	Wraps a payload key using an AES key on the HSM and the AES-PKCS5-PAD wrapping mechanism.	CU
key wrap aes-zero-pad	Wraps a payload key using an AES key on the HSM and the AES-ZERO-PAD wrapping mechanism.	CU
key wrap cloudhsm-aes-gcm	Wraps a payload key using an AES key on the HSM and the CLOUDHSM-AES-GCM wrapping mechanism.	CUs
key wrap rsa-aes	Wraps a payload key using an RSA public key on the HSM and the RSA-AES wrapping mechanism.	CU
key wrap rsa-oaep	Wraps a payload key using an RSA public key on the HSM and the RSA-OAEP wrapping mechanism.	CU
	Wraps a payload key using an RSA public key on the HSM and the RSA-PKCS wrapping mechanism.	CU
login	Log in to your AWS CloudHSM cluster.	Admin, crypto user (CU), and appliance user (AU)
logout	Log out of your AWS CloudHSM cluster.	Admin, CU, and appliance user (AU)
quorum token-sign delete	Deletes one or more tokens for a quorum authorized service.	Admin
quorum token-sign generate	Generates a token for a quorum authorized service.	Admin
quorum token-sign list	Lists all token-sign quorum tokens present in your CloudHSM cluster.	All 1, including unauthenticated users. Login is not required.
quorum token-sign list-quorum-values	Lists the quorum values set in your CloudHSM cluster.	All 1, including unauthenticated users. Login is not required.
quorum token-sign list-timeouts	Obtains the token timeout period in seconds for all token types.	Admin and crypto user
quorum token-sign set-quorum-value	Sets a new quorum value for a quorum authorized service.	Admin
quorum token-sign set-timeout	Sets the token timeout period in seconds for each token type.	Admin
user change-mfa	Changes a user's multi-factor authentication (MFA) strategy.	Admin, CU
user change-password	Changes the passwords of users on the HSMs. Any user can change their own password. Admins can change anyone's password.	Admin, CU
user create	Creates a user in your AWS CloudHSM cluster.	Admin
user delete	Deletes a user in your AWS CloudHSM cluster.	Admin
user list	Lists the users in your AWS CloudHSM cluster.	All 1, including unauthenticated users. Login is not required.
user change-quorum token-sign register	Registers the quorum token-sign quorum strategy for a user.	Admin

Annotations

• [1] All users includes all listed roles and users not logged in.