| Copyright | (c) 2013-2021 Brendan Hay |
|---|---|
| License | Mozilla Public License, v. 2.0. |
| Maintainer | Brendan Hay <brendan.g.hay+amazonka@gmail.com> |
| Stability | auto-generated |
| Portability | non-portable (GHC extensions) |
| Safe Haskell | None |
Amazonka.KMS.ConnectCustomKeyStore
Description
Connects or reconnects a custom key store to its associated CloudHSM cluster.
The custom key store must be connected before you can create KMS keys in the key store or use the KMS keys it contains. You can disconnect and reconnect a custom key store at any time.
To connect a custom key store, its associated CloudHSM cluster must have at least one active HSM. To get the number of active HSMs in a cluster, use the DescribeClusters operation. To add HSMs to the cluster, use the CreateHsm operation. Also, the kmsuser crypto user (CU) must not be logged into the cluster. This prevents KMS from using this account to log in.
The connection process can take an extended amount of time to complete; up to 20 minutes. This operation starts the connection process, but it does not wait for it to complete. When it succeeds, this operation quickly returns an HTTP 200 response and a JSON object with no properties. However, this response does not indicate that the custom key store is connected. To get the connection state of the custom key store, use the DescribeCustomKeyStores operation.
During the connection process, KMS finds the CloudHSM cluster that is
associated with the custom key store, creates the connection
infrastructure, connects to the cluster, logs into the CloudHSM client
as the kmsuser CU, and rotates its password.
The ConnectCustomKeyStore operation might fail for various reasons. To
find the reason, use the DescribeCustomKeyStores operation and see the
ConnectionErrorCode in the response. For help interpreting the
ConnectionErrorCode, see CustomKeyStoresListEntry.
To fix the failure, use the DisconnectCustomKeyStore operation to
disconnect the custom key store, correct the error, use the
UpdateCustomKeyStore operation if necessary, and then use
ConnectCustomKeyStore again.
If you are having trouble connecting or disconnecting a custom key store, see Troubleshooting a Custom Key Store in the Key Management Service Developer Guide.
Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.
Required permissions: kms:ConnectCustomKeyStore (IAM policy)
Related operations
- CreateCustomKeyStore
- DeleteCustomKeyStore
- DescribeCustomKeyStores
- DisconnectCustomKeyStore
- UpdateCustomKeyStore
Synopsis
- data ConnectCustomKeyStore = ConnectCustomKeyStore' {}
- newConnectCustomKeyStore :: Text -> ConnectCustomKeyStore
- connectCustomKeyStore_customKeyStoreId :: Lens' ConnectCustomKeyStore Text
- data ConnectCustomKeyStoreResponse = ConnectCustomKeyStoreResponse' {
- httpStatus :: Int
- newConnectCustomKeyStoreResponse :: Int -> ConnectCustomKeyStoreResponse
- connectCustomKeyStoreResponse_httpStatus :: Lens' ConnectCustomKeyStoreResponse Int
Creating a Request
data ConnectCustomKeyStore Source #
See: newConnectCustomKeyStore smart constructor.
Constructors
| ConnectCustomKeyStore' | |
Fields
| |
Instances
newConnectCustomKeyStore Source #
Create a value of ConnectCustomKeyStore with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:customKeyStoreId:ConnectCustomKeyStore', connectCustomKeyStore_customKeyStoreId - Enter the key store ID of the custom key store that you want to connect.
To find the ID of a custom key store, use the DescribeCustomKeyStores
operation.
Request Lenses
connectCustomKeyStore_customKeyStoreId :: Lens' ConnectCustomKeyStore Text Source #
Enter the key store ID of the custom key store that you want to connect. To find the ID of a custom key store, use the DescribeCustomKeyStores operation.
Destructuring the Response
data ConnectCustomKeyStoreResponse Source #
See: newConnectCustomKeyStoreResponse smart constructor.
Constructors
| ConnectCustomKeyStoreResponse' | |
Fields
| |
Instances
newConnectCustomKeyStoreResponse Source #
Create a value of ConnectCustomKeyStoreResponse with all optional fields omitted.
Use generic-lens or optics to modify other optional fields.
The following record fields are available, with the corresponding lenses provided for backwards compatibility:
$sel:httpStatus:ConnectCustomKeyStoreResponse', connectCustomKeyStoreResponse_httpStatus - The response's http status code.
Response Lenses
connectCustomKeyStoreResponse_httpStatus :: Lens' ConnectCustomKeyStoreResponse Int Source #
The response's http status code.