Connects or reconnects a custom key store
to its associated AWS CloudHSM cluster.
The custom key store must be connected before you can create customer master keys (CMKs) in the key store or use the CMKs it contains. You can disconnect and reconnect a custom key store at any time.
To connect a custom key store, its associated AWS CloudHSM cluster must have at least one active HSM. To get the number of active HSMs in a cluster, use the DescribeClusters
operation. To add HSMs to the cluster, use the CreateHsm
The connection process can take an extended amount of time to complete; up to 20 minutes. This operation starts the connection process, but it does not wait for it to complete. When it succeeds, this operation quickly returns an HTTP 200 response and a JSON object with no properties. However, this response does not indicate that the custom key store is connected. To get the connection state of the custom key store, use the DescribeCustomKeyStores
During the connection process, AWS KMS finds the AWS CloudHSM cluster that is associated with the custom key store, creates the connection infrastructure, connects to the cluster, logs into the AWS CloudHSM client as the
kmsuser crypto user
(CU), and rotates its password.
operation might fail for various reasons. To find the reason, use the DescribeCustomKeyStores
operation and see the
in the response. For help interpreting the
, see CustomKeyStoresListEntry
To fix the failure, use the DisconnectCustomKeyStore
operation to disconnect the custom key store, correct the error, use the UpdateCustomKeyStore
operation if necessary, and then use
If you are having trouble connecting or disconnecting a custom key store, see Troubleshooting a Custom Key Store
in the AWS Key Management Service Developer Guide