diff --git a/.gitignore b/.gitignore
index 9563bc61d..699939426 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,40 +1,38 @@
 .DS_Store
 
 node_modules
 
 landing/node_modules
 landing/dist
 
 lib/node_modules
 
 native/cpp/CommonCpp/CryptoTools/opaque-ke-cxx/target
 
 web/node_modules
 web/dist
 
 keyserver/dist
 keyserver/node_modules
 keyserver/secrets
 keyserver/facts
 keyserver/*.env
 keyserver/*.env.*
 
-services/identity/target
-services/identity/secrets
 services/tunnelbroker/rust-lib/target
 services/tunnelbroker/tunnelbroker.ini
 
 .eslintcache
 .vscode
 !.vscode/extensions.json
 
 # CMake
 native/cpp/**/build
 services/*/build
 services/build
 services/lib/src/build
 shared/protos/build
 
 # Nix
 result*
 services/backup/blob_client/target/
diff --git a/services/identity/.gitignore b/services/identity/.gitignore
new file mode 100644
index 000000000..da2d74c3a
--- /dev/null
+++ b/services/identity/.gitignore
@@ -0,0 +1,2 @@
+secrets
+target
diff --git a/services/identity/src/main.rs b/services/identity/src/main.rs
index babac9598..850212e07 100644
--- a/services/identity/src/main.rs
+++ b/services/identity/src/main.rs
@@ -1,62 +1,65 @@
 use clap::{Parser, Subcommand};
 use database::DatabaseClient;
 use tonic::transport::Server;
 use tracing_subscriber::FmtSubscriber;
 
 mod config;
 mod constants;
 mod database;
 mod keygen;
 mod opaque;
 mod service;
 mod token;
 
 use config::Config;
 use constants::{IDENTITY_SERVICE_SOCKET_ADDR, SECRETS_DIRECTORY};
 use keygen::generate_and_persist_keypair;
 use service::{IdentityServiceServer, MyIdentityService};
 
 #[derive(Parser)]
 #[clap(author, version, about, long_about = None)]
 #[clap(propagate_version = true)]
 struct Cli {
   #[clap(subcommand)]
   command: Commands,
 }
 
 #[derive(Subcommand)]
 enum Commands {
   /// Runs the server
   Server,
   /// Generates and persists a keypair to use for PAKE registration and login
   Keygen {
     #[clap(short, long)]
     #[clap(default_value_t = String::from(SECRETS_DIRECTORY))]
     dir: String,
   },
+  /// Populates the `identity-users` table in DynamoDB from MySQL
+  PopulateDB,
 }
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
   let subscriber = FmtSubscriber::new();
   tracing::subscriber::set_global_default(subscriber)?;
   let cli = Cli::parse();
   match &cli.command {
     Commands::Keygen { dir } => {
       generate_and_persist_keypair(dir)?;
     }
     Commands::Server => {
       let addr = IDENTITY_SERVICE_SOCKET_ADDR.parse()?;
       let config = Config::load()?;
       let aws_config = aws_config::from_env().region("us-east-2").load().await;
       let database_client = DatabaseClient::new(&aws_config);
       let identity_service = MyIdentityService::new(config, database_client);
       Server::builder()
         .add_service(IdentityServiceServer::new(identity_service))
         .serve(addr)
         .await?;
     }
+    Commands::PopulateDB => unimplemented!(),
   }
 
   Ok(())
 }