I don’t want to use AWS CloudHSM Classic anymore, or my trial period has expired and I’ve decided I don’t want to use CloudHSM Classic. How do I stop using CloudHSM Classic and ensure I’m not billed for further usage?

To stop using CloudHSM Classic and stop any charges associated with the CloudHSM Classic service, you must first zeroize your HSM appliance, and then de-provision your HSM appliance.

To zeroize your HSM appliance:

1.    Log in to the control (client) instance.

2.    From the control instance, connect to your HSM appliance over SSH by using the following command, where private_key_file is your HSM's private key file and hsm_ip_address is the IP address of your HSM appliance:

$ ssh -i private_key_file manager@hsm_ip_address

3.    Run the following command:

lunash:> hsm login

4.    Intentionally enter the wrong administrator password three times in a row. This will zeroize your HSM appliance.

Next, de-provision your HSM device by using the delete-hsm command of the AWS CloudHSM CLI or the DeleteHsm AWS CloudHSM API command.

To confirm that a device has been successfully de-provisioned, run the DescribeHsm API call and verify the device is in the TERMINATED state. A state other than TERMINATED indicates that the HSM appliance wasn't successfully zeroized before it was de-provisioned, and billing for CloudHSM Classic will continue.

If you have any questions about discontinuing CloudHSM Classic for your account, contact AWS support.


Did this page help you? Yes | No

Back to the AWS Support Knowledge Center

Need help? Visit the AWS Support Center

Published: 2016-10-26

Updated: 2017-10-13