All commands are available to SEC_ADMINs. Other users can view only those Cloud Admin Groups of which they are a member. They cannot make any changes to those groups.

hicli Command

Description

group list

List the Cloud Admin Groups defined in Cryptographic Security Platform Vault.

group new

Create a new Cloud Admin Group.

group detail

View the details for the selected Cloud Admin Group.

group rm

Remove the selected Cloud Admin Group.

Tip: One common problem is that, even after you remove all the users from a group, group removal fails because the group is still associated with one or more Cloud VM Sets. To avoid this, make sure you remove all associations between the group and any Cloud VM Sets before you remove the users. At that point you can remove the group.

group add_user

Add a Cryptographic Security Platform Vault-managed user account to the selected Cloud Admin Group. This user account must already be defined in Cryptographic Security Platform Vault.

group rm_user

Remove a Cryptographic Security Platform Vault-managed user account from the selected Cloud Admin Group.

group set description

Change the description for the selected Cloud Admin Group.

group set name

Change the name of the selected Cloud Admin Group.

Examples

Note: In the following examples, the responses shown for the hicli group list command are truncated to display just the group name and membership lists. The full output shows additional details for the Cloud Admin Groups such as the group description and whether the group can be deleted from Cryptographic Security Platform Vault.

View the current set of Cloud Admin Groups:

$ hicli group list
Group Name              | AD Group Members                                   | User Members
-----------------------------------------------------------------------------------------------
Cloud Admin Group       | Azure Admins                                       | secroot

Display more detailed information about a specific group:

$ hicli group detail "Cloud Admin Group"
Name                     | Cloud Admin Group
Description              | Default Group for Administering Cloud VMs
Type                     | CLOUD_ADMIN
Number of objects        | 0
AC Policy Max Changes    | 50
User Members             | secroot
AD Group Members         | Azure Admins

Create a new Cloud Admin Group called cld_group1 and add the AD Security group AWS Admins to that Cloud Admin Group:

# hicli group new cld_group1 --privilege=CLOUD_ADMIN --adgroup_members='[{"distinguishedName": "CN=AWS Admins,CN=Users,DC=manualtest,DC=qa,DC=dc,DC=hytrust,DC=com", "objectGUID": "29739b20-2fb2-4b99-b7a8-935560b5c8f4", "cn": "AWS Admins"}]'
#
# hicli group list
Group Name             | AD Group Members                                   | User Members
-----------------------------------------------------------------------------------------------
Cloud Admin Group      | Azure Admins                                       | secroot
cld_group1             | AWS Admins                                         |

Change the AD Security group membership for cld_group1 to VMware Admins. This command removes any existing AD group members from the Cloud Admin Group.

# hicli group set cld_group1 --adgroup_members='[{"distinguishedName": "CN=VMware Admins,CN=Users,DC=manualtest,DC=qa,DC=dc,DC=hytrust,DC=com", "objectGUID": "b2e5d325-1d2c-455a-b2ee-9408fd9e4841", "cn": "VMware Admins"}]'
#
# hicli group list
Group Name             | AD Group Members                                   | User Members
-----------------------------------------------------------------------------------------------
Cloud Admin Group      | Azure Admins                                       | secroot
cld_group1             | VMware Admins                                      |