hsms

Creates, updates, deletes, gets or lists a hsms resource.

Overview

Name	hsms
Type	Resource
Id	aws.cloudhsm.hsms

Fields

The following fields are returned by SELECT queries:

describe_hsm

Name	Datatype	Description
availability_zone	string	The Availability Zone that the HSM is in. (pattern: <code>[a-zA-Z0-9-]*</code>)
eni_id	string	The identifier of the elastic network interface (ENI) attached to the HSM. (pattern: <code>eni-[0-9a-f]{8}</code>)
eni_ip	string	The IP address assigned to the HSM's ENI. (pattern: <code>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}</code>)
hsm_arn	string	An ARN that identifies an HSM. (pattern: <code>arn:aws(-iso)?:cloudhsm:[a-zA-Z0-9-]*:[0-9]{12}:hsm-[0-9a-f]{8}</code>)
hsm_type	string	The HSM model type. (pattern: <code>[\w :+=./\-]*</code>)
iam_role_arn	string	The ARN of the IAM role assigned to the HSM. (pattern: <code>arn:aws(-iso)?:iam::[0-9]{12}:role/[a-zA-Z0-9_+=,.-@]{1,64}</code>)
partitions	array	The list of partitions on the HSM.
serial_number	string	The serial number of the HSM. (pattern: <code>\d{1,16}</code>)
server_cert_last_updated	string	The date and time that the server certificate was last updated. (pattern: <code>\d*</code>)
server_cert_uri	string	The URI of the certificate server. (pattern: <code>[\w :+=./\-]*</code>)
software_version	string	The HSM software version. (pattern: <code>[\w :+=./\-]*</code>)
ssh_key_last_updated	string	The date and time that the SSH key was last updated. (pattern: <code>\d*</code>)
ssh_public_key	string	The public SSH key. (pattern: <code>[a-zA-Z0-9+/= ._:\@-]*</code>)
status	string	The status of the HSM. (PENDING, RUNNING, UPDATING, SUSPENDED, TERMINATING, TERMINATED, DEGRADED)
status_details	string	Contains additional information about the status of the HSM. (pattern: <code>[\w :+=./\-]*</code>)
subnet_id	string	The identifier of the subnet that the HSM is in. (pattern: <code>subnet-[0-9a-f]{8}</code>)
subscription_end_date	string	The subscription end date. (pattern: <code>\d*</code>)
subscription_start_date	string	The subscription start date. (pattern: <code>\d*</code>)
subscription_type	string	Specifies the type of subscription for the HSM. PRODUCTION - The HSM is being used in a production environment. TRIAL - The HSM is being used in a product trial. (PRODUCTION)
vendor_name	string	The name of the HSM vendor. (pattern: <code>[\w :+=./\-]*</code>)
vpc_id	string	The identifier of the VPC that the HSM is in. (pattern: <code>vpc-[0-9a-f]{8}</code>)

list_hsms

Name	Datatype	Description
hsm	string	The list of ARNs that identify the HSMs.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_hsm	select	region		This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves information about an HSM. You can identify the HSM by its ARN or its serial number.
list_hsms	select	region		This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves the identifiers of all of the HSMs provisioned for the current customer. This operation supports pagination with the use of the NextToken member. If more results are available, the NextToken member of the response contains a token that you pass in the next call to ListHsms to retrieve the next set of items.
create_hsm	insert	region, SubnetId, SshKey, IamRoleArn, SubscriptionType		This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Creates an uninitialized HSM instance. There is an upfront fee charged for each HSM instance that you create with the CreateHsm operation. If you accidentally provision an HSM and want to request a refund, delete the instance using the DeleteHsm operation, go to the AWS Support Center, create a new case, and select Account and Billing Support. It can take up to 20 minutes to create and provision an HSM. You can monitor the status of the HSM with the DescribeHsm operation. The HSM is ready to be initialized when the status changes to RUNNING.
modify_hsm	update	region, HsmArn		This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Modifies an HSM. This operation can result in the HSM being offline for up to 15 minutes while the AWS CloudHSM service is reconfigured. If you are modifying a production HSM, you should ensure that your AWS CloudHSM service is configured for high availability, and consider executing this operation during a maintenance window.
delete_hsm	delete	region		This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Deletes an HSM. After completion, this operation cannot be undone and your key material cannot be recovered.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_hsm

This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves information about an HSM. You can identify the HSM by its ARN or its serial number.

SELECT
availability_zone,
eni_id,
eni_ip,
hsm_arn,
hsm_type,
iam_role_arn,
partitions,
serial_number,
server_cert_last_updated,
server_cert_uri,
software_version,
ssh_key_last_updated,
ssh_public_key,
status,
status_details,
subnet_id,
subscription_end_date,
subscription_start_date,
subscription_type,
vendor_name,
vpc_id
FROM aws.cloudhsm.hsms
WHERE region = '{{ region }}' -- required
;

list_hsms

This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Retrieves the identifiers of all of the HSMs provisioned for the current customer. This operation supports pagination with the use of the NextToken member. If more results are available, the NextToken member of the response contains a token that you pass in the next call to ListHsms to retrieve the next set of items.

SELECT
hsm
FROM aws.cloudhsm.hsms
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_hsm

This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Creates an uninitialized HSM instance. There is an upfront fee charged for each HSM instance that you create with the CreateHsm operation. If you accidentally provision an HSM and want to request a refund, delete the instance using the DeleteHsm operation, go to the AWS Support Center, create a new case, and select Account and Billing Support. It can take up to 20 minutes to create and provision an HSM. You can monitor the status of the HSM with the DescribeHsm operation. The HSM is ready to be initialized when the status changes to RUNNING.

INSERT INTO aws.cloudhsm.hsms (
SubnetId,
SshKey,
EniIp,
IamRoleArn,
ExternalId,
SubscriptionType,
ClientToken,
SyslogIp,
region
)
SELECT 
'{{ SubnetId }}' /* required */,
'{{ SshKey }}' /* required */,
'{{ EniIp }}',
'{{ IamRoleArn }}' /* required */,
'{{ ExternalId }}',
'{{ SubscriptionType }}' /* required */,
'{{ ClientToken }}',
'{{ SyslogIp }}',
'{{ region }}'
RETURNING
hsm_arn
;

Manifest

# Description fields are for documentation purposes
- name: hsms
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the hsms resource.
  - name: SubnetId
    value: "{{ SubnetId }}"
    description: |
      The identifier of the subnet in your VPC in which to place the HSM.
  - name: SshKey
    value: "{{ SshKey }}"
    description: |
      The SSH public key to install on the HSM.
  - name: EniIp
    value: "{{ EniIp }}"
    description: |
      The IP address to assign to the HSM's ENI. If an IP address is not specified, an IP address will be randomly chosen from the CIDR range of the subnet.
  - name: IamRoleArn
    value: "{{ IamRoleArn }}"
    description: |
      The ARN of an IAM role to enable the AWS CloudHSM service to allocate an ENI on your behalf.
  - name: ExternalId
    value: "{{ ExternalId }}"
    description: |
      The external ID from IamRoleArn, if present.
  - name: SubscriptionType
    value: "{{ SubscriptionType }}"
    description: |
      Specifies the type of subscription for the HSM. PRODUCTION - The HSM is being used in a production environment. TRIAL - The HSM is being used in a product trial.
    valid_values: ['PRODUCTION']
  - name: ClientToken
    value: "{{ ClientToken }}"
    description: |
      A user-defined token to ensure idempotence. Subsequent calls to this operation with the same token will be ignored.
  - name: SyslogIp
    value: "{{ SyslogIp }}"
    description: |
      The IP address for the syslog monitoring server. The AWS CloudHSM service only supports one syslog monitoring server.

UPDATE examples

modify_hsm

This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Modifies an HSM. This operation can result in the HSM being offline for up to 15 minutes while the AWS CloudHSM service is reconfigured. If you are modifying a production HSM, you should ensure that your AWS CloudHSM service is configured for high availability, and consider executing this operation during a maintenance window.

UPDATE aws.cloudhsm.hsms
SET 
HsmArn = '{{ HsmArn }}',
SubnetId = '{{ SubnetId }}',
EniIp = '{{ EniIp }}',
IamRoleArn = '{{ IamRoleArn }}',
ExternalId = '{{ ExternalId }}',
SyslogIp = '{{ SyslogIp }}'
WHERE 
region = '{{ region }}' --required
AND HsmArn = '{{ HsmArn }}' --required
RETURNING
hsm_arn;

DELETE examples

delete_hsm

This is documentation for AWS CloudHSM Classic. For more information, see AWS CloudHSM Classic FAQs, the AWS CloudHSM Classic User Guide, and the AWS CloudHSM Classic API Reference. For information about the current version of AWS CloudHSM, see AWS CloudHSM, the AWS CloudHSM User Guide, and the AWS CloudHSM API Reference. Deletes an HSM. After completion, this operation cannot be undone and your key material cannot be recovered.

DELETE FROM aws.cloudhsm.hsms
WHERE region = '{{ region }}' --required
;