user create - AWS CloudHSM

user create

The user create command in CloudHSM CLI creates a user in your AWS CloudHSM cluster. Only user accounts with the admin role can run this command.

User type

The following types of users can run this command.

  • Admin


To run this command, you must be logged in as an admin user


aws-cloudhsm > help user create Create a new user Usage: cloudhsm-cli user create [OPTIONS] --username <USERNAME> --role <ROLE> [--password <PASSWORD>] Options: --cluster-id <CLUSTER_ID> Unique Id to choose which of the clusters in the config file to run the operation against. If not provided, will fall back to the value provided when interactive mode was started, or error --username <USERNAME> Username to access the HSM cluster --role <ROLE> Role the user has in the cluster Possible values: - crypto-user: A CryptoUser has the ability to manage and use keys - admin: An Admin has the ability to manage user accounts --password <PASSWORD> Optional: Plaintext user's password. If you do not include this argument you will be prompted for it --approval <APPROVAL> Filepath of signed quorum token file to approve operation -h, --help Print help (see a summary with '-h')


These examples show how to use user create to create new users in your HSMs.

Example : Create a crypto user

This example creates an account in your AWS CloudHSM cluster with the crypto user role.

aws-cloudhsm > user create --username alice --role crypto-user Enter password: Confirm password: { "error_code": 0, "data": { "username": "alice", "role": "crypto-user" } }



The ID of the cluster to run this operation on.

Required: If multiple clusters have been configured.


Specifies a friendly name for the user. The maximum length is 31 characters. The only special character permitted is an underscore ( _ ). The username is not case sensitive in this command, username is always displayed in lowercase.

Required: Yes


Specifies the role assigned to this user. This parameter is required. Valid values are admin, crypto-user.

To get the user’s role, use the user list command. For detailed information about the user types on an HSM, see Understanding HSM users.


Specifies the password of the user who is logging in to the HSMs.

Required: Yes


Specifies the file path to a signed quorum token file to approve operation. Only required if quorum user service quorum value is greater than 1.

Related topics