How to create HSM users - Key Management Service - Alibaba Cloud Documentation Center

Use the createUser command to add a user account to all nodes in your Hardware Security Module (HSM) cluster. Only administrators (CO) can run this command.

Prerequisites

Before you begin, ensure that you have:

hsm_mgmt_tool started
An active HSM session
CO (administrator) credentials for the logged-in user

User type

The following user type can run this command. For descriptions of all user types, see HSM User Permissions Table.

Administrator (CO)

Syntax

createUser <user-type> <user-name> <password | -hpswd>

Enter the parameters in the order shown above. To avoid exposing the password in plaintext, use -hpswd instead of the actual password and follow the prompts. For parameter details, see Parameters.

Important

Enter the parameters in the sequence defined by the syntax.

Examples

Create an administrator (CO)

This example creates a CO user named alice with the password alice_pswd.

Log on to the HSM as a CO using the loginHSM command. For instructions, see loginHSM and logoutHSM.
```
cloudmgmt>loginHSM CO admin password
loginHSM success on server 0(172.16.0.2)
```

Run createUser to add the new user.

cloudmgmt>createUser CO alice alice_pswd
*************************CAUTION********************************
This is a CRITICAL operation, should be done on all nodes in the
cluster. Cav server does NOT synchronize these changes with the
nodes on which this operation is not executed or failed, please
ensure this operation is executed on all nodes in the cluster.
****************************************************************

Do you want to continue(y/n)?y
Creating User alice(CO) on 1 nodes
createUser success on server 0(172.16.0.2)

Confirm the user was created with the listUsers command. For more information, see listUsers.

aws-cloudhsm> listUsers
Users on server 0(172.16.0.2):
Number of users found:4

    User Id    		User Type      	User Name      			   MofnPubKey  	 LoginFailureCnt       	 2FA
         1     		CO     		admin                                  	 NO               0    	       	  NO
         2     		AU     		app_user                               	 NO               0    	       	  NO
         3     		CU     		crypto_user                            	 NO               0    	       	  NO
         4     		CO     		alice                                  	 NO               0    	       	  NO

Create a crypto user (CU)

This example creates a CU user named bob with the password bob_pswd.

Log on to the HSM as a CO.

cloudmgmt>loginHSM CO admin password
loginHSM success on server 0(172.16.0.2)

Run createUser to add the CU user.

cloudmgmt>createUser CU bob bob_pswd
*************************CAUTION********************************
This is a CRITICAL operation, should be done on all nodes in the
cluster. Cav server does NOT synchronize these changes with the
nodes on which this operation is not executed or failed, please
ensure this operation is executed on all nodes in the cluster.
****************************************************************

Do you want to continue(y/n)?y
Creating User bob(CU) on 1 nodes
createUser success on server 0(172.16.0.2)

Confirm the user was created with listUsers.

Parameters

Parameter	Description	Required	Valid values
`<user-type>`	The type of user to create. Note For full descriptions of each user type, see HSM User Permissions Table.	Yes	`CO` — Administrators. `CU` — Crypto users. `AU` — Audit users.
`<user-name>`	The username for the new user. Not case-sensitive.	Yes	No specific requirements
`<password \| -hpswd>`	The password for the new user. Must be 7–32 characters and is case-sensitive. Use `-hpswd` to avoid displaying the password in plaintext.	Yes	No specific requirements