CustomKeyStoresListEntry

INTERNAL_ERROR — Amazon KMS could not complete the request due to an internal error. Retry the request. For ConnectCustomKeyStore requests, disconnect the custom key store before trying to connect again.

NETWORK_ERRORS — Network errors are preventing Amazon KMS from connecting the custom key store to its backing key store.

CLUSTER_NOT_FOUND — Amazon KMS cannot find the Amazon CloudHSM cluster with the specified cluster ID.

INSUFFICIENT_CLOUDHSM_HSMS — The associated Amazon CloudHSM cluster does not contain any active HSMs. To connect a custom key store to its Amazon CloudHSM cluster, the cluster must contain at least one active HSM.

INSUFFICIENT_FREE_ADDRESSES_IN_SUBNET — At least one private subnet associated with the Amazon CloudHSM cluster doesn't have any available IP addresses. A Amazon CloudHSM key store connection requires one free IP address in each of the associated private subnets, although two are preferable. For details, see How to Fix a Connection Failure in the Amazon Key Management Service Developer Guide.

INVALID_CREDENTIALS — The KeyStorePassword for the custom key store doesn't match the current password of the kmsuser crypto user in the Amazon CloudHSM cluster. Before you can connect your custom key store to its Amazon CloudHSM cluster, you must change the kmsuser account password and update the KeyStorePassword value for the custom key store.

SUBNET_NOT_FOUND — A subnet in the Amazon CloudHSM cluster configuration was deleted. If Amazon KMS cannot find all of the subnets in the cluster configuration, attempts to connect the custom key store to the Amazon CloudHSM cluster fail. To fix this error, create a cluster from a recent backup and associate it with your custom key store. (This process creates a new cluster configuration with a VPC and private subnets.) For details, see How to Fix a Connection Failure in the Amazon Key Management Service Developer Guide.

USER_LOCKED_OUT — The kmsuser CU account is locked out of the associated Amazon CloudHSM cluster due to too many failed password attempts. Before you can connect your custom key store to its Amazon CloudHSM cluster, you must change the kmsuser account password and update the key store password value for the custom key store.

USER_LOGGED_IN — The kmsuser CU account is logged into the associated Amazon CloudHSM cluster. This prevents Amazon KMS from rotating the kmsuser account password and logging into the cluster. Before you can connect your custom key store to its Amazon CloudHSM cluster, you must log the kmsuser CU out of the cluster. If you changed the kmsuser password to log into the cluster, you must also and update the key store password value for the custom key store. For help, see How to Log Out and Reconnect in the Amazon Key Management Service Developer Guide.

USER_NOT_FOUND — Amazon KMS cannot find a kmsuser CU account in the associated Amazon CloudHSM cluster. Before you can connect your custom key store to its Amazon CloudHSM cluster, you must create a kmsuser CU account in the cluster, and then update the key store password value for the custom key store.

INVALID_CREDENTIALS — One or both of the XksProxyAuthenticationCredential values is not valid on the specified external key store proxy.

XKS_PROXY_ACCESS_DENIED — Amazon KMS requests are denied access to the external key store proxy. If the external key store proxy has authorization rules, verify that they permit Amazon KMS to communicate with the proxy on your behalf.

XKS_PROXY_INVALID_CONFIGURATION — A configuration error is preventing the external key store from connecting to its proxy. Verify the value of the XksProxyUriPath.

XKS_PROXY_INVALID_RESPONSE — Amazon KMS cannot interpret the response from the external key store proxy. If you see this connection error code repeatedly, notify your external key store proxy vendor.

XKS_PROXY_INVALID_TLS_CONFIGURATION — Amazon KMS cannot connect to the external key store proxy because the TLS configuration is invalid. Verify that the XKS proxy supports TLS 1.2 or 1.3. Also, verify that the TLS certificate is not expired, and that it matches the hostname in the XksProxyUriEndpoint value, and that it is signed by a certificate authority included in the Trusted Certificate Authorities list.

XKS_PROXY_NOT_REACHABLE — Amazon KMS can't communicate with your external key store proxy. Verify that the XksProxyUriEndpoint and XksProxyUriPath are correct. Use the tools for your external key store proxy to verify that the proxy is active and available on its network. Also, verify that your external key manager instances are operating properly. Connection attempts fail with this connection error code if the proxy reports that all external key manager instances are unavailable.

XKS_PROXY_TIMED_OUT — Amazon KMS can connect to the external key store proxy, but the proxy does not respond to Amazon KMS in the time allotted. If you see this connection error code repeatedly, notify your external key store proxy vendor.

XKS_VPC_ENDPOINT_SERVICE_INVALID_CONFIGURATION — The Amazon VPC endpoint service configuration doesn't conform to the requirements for an Amazon KMS external key store.

XKS_VPC_ENDPOINT_SERVICE_NOT_FOUND — Amazon KMS can't find the VPC endpoint service that it uses to communicate with the external key store proxy. Verify that the XksProxyVpcEndpointServiceName is correct and the Amazon KMS service principal has service consumer permissions on the Amazon VPC endpoint service.