--account-id string the account being connected; the connection's own when unset, and refused if these credentials belong elsewhere
--artifact-key string KMS alias, ARN or awskms:// provider URL sealing credentials Kubox stores for this account; must be a different key; alias/kubox-artifacts when unset
--connection string the connection to complete, by the id the console showed or by its name; the positional name when unset
--creator-role string name for the role Kubox assumes to build in this account (default "KuboxClusterCreator")
-h, --help help for verify
--hosted-zone string Route53 zone the build role may publish records in, scoped to it alone; omit it and the connection publishes no DNS
--plan render the transaction this would perform, and perform none of it; works with -o json
--profile string the AWS profile to use; overrides AWS_PROFILE, so you choose the profile the connection was set up under
--region string region clusters in this account are built in; the connection's own when unset
--sealer-role string name for the tenant-local role runs seal this account's credentials through (ADR-0002) (default "KuboxTenantArtifactSealer")
--stack-key string KMS alias, ARN or awskms:// provider URL encrypting this account's Pulumi checkpoints; alias/kubox-stacks when unset
--state-backend string where this account's Pulumi state lives, as s3://bucket/prefix; derived from the connection when unset
--unsealer-role string name for the tenant-local role that opens this account's sealed credentials (default "KuboxTenantArtifactUnsealer")
