DISASSOCIATEDATASETKMSKEY()`¶

About DisassociateDatasetKmsKey¶

Removes the customer managed Amazon Web Services Key Management Service (Amazon Web Services KMS) key association from the specified dataset. After this operation completes, data that you publish to the dataset is encrypted at rest using an Amazon Web Services owned key managed by Amazon CloudWatch.

Only the default dataset is supported. To call this operation, the dataset must currently have a customer managed KMS key associated with it. If the dataset has no associated KMS key, the operation fails with ResourceNotFoundException.

Amazon CloudWatch performs a dry-run kms:Decrypt call on the key as part of this operation. This verifies that the caller is authorized to use the currently associated key. The caller must have kms:Decrypt permission on the currently associated key, and the key must be enabled and accessible. If the key has been disabled or scheduled for deletion, you must first re-enable or restore it before you can disassociate it from the dataset.

Disassociating a KMS key from a dataset does not immediately remove the kms:Decrypt requirement on data plane operations. For up to three hours after disassociation, callers must continue to have kms:Decrypt permission on the previously associated key. Some data may still be encrypted with that key during this window. After this enforcement window elapses, the kms:Decrypt requirement is lifted.

For more information about using customer managed keys with Amazon CloudWatch, see Encryption at rest with customer managed keys in the Amazon CloudWatch User Guide.

Method Signature¶

METHODS /AWS1/IF_CWT~DISASSOCIATEDATASETKMSKEY
  IMPORTING
    !IV_DATASETIDENTIFIER TYPE /AWS1/CWTDATASETIDENTIFIER OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_cwtdassocdskmskeyout
  RAISING
    /AWS1/CX_CWTCONFLICTEXCEPTION
    /AWS1/CX_CWTRESOURCENOTFOUNDEX
    /AWS1/CX_CWTCLIENTEXC
    /AWS1/CX_CWTSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING¶

Required arguments:¶

`iv_datasetidentifier` `TYPE /AWS1/CWTDATASETIDENTIFIER` `/AWS1/CWTDATASETIDENTIFIER`¶

Specifies the identifier of the dataset from which to remove the KMS key association. For the default dataset, you can specify either default or the full dataset Amazon Resource Name (ARN) in the format arn:aws:cloudwatch:Region:account-id:dataset/default.

RETURNING¶

`oo_output` `TYPE REF TO /aws1/cl_cwtdassocdskmskeyout` `/AWS1/CL_CWTDASSOCDSKMSKEYOUT`¶

Examples¶

Syntax Example¶

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->disassociatedatasetkmskey( |string| ).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
ENDIF.

/AWS1/IF_CWT=>DISASSOCIATEDATASETKMSKEY()¶