AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Associates an Amazon Web Services Key Management Service (Amazon Web Services KMS)
customer managed key with the specified dataset. After this operation completes, all
data published to the dataset is encrypted at rest using the specified KMS key. Callers
must have kms:Decrypt permission on the key to read the encrypted data.
Only the default dataset is supported. The default dataset is implicit
for every account in every Region — you do not need to create it before calling this
operation.
You can call AssociateDatasetKmsKey on a dataset that is already associated
with a KMS key to replace the existing key with a different one. The caller must have
kms:Decrypt permission on both the current key and the new key.
If the currently associated key has been deleted, is scheduled for deletion, is pending
import, is unavailable, or has been disabled, Amazon CloudWatch does not require kms:Decrypt
permission on the current key and the rotation proceeds. If the key was only disabled,
consider re-enabling it instead of rotating, because re-enabling allows Amazon CloudWatch
to resume decrypting your existing metric data encrypted with that key.
The KMS key that you specify must meet all of the following requirements:
It must be a symmetric encryption KMS key (key spec SYMMETRIC_DEFAULT, key
usage ENCRYPT_DECRYPT). Asymmetric keys, HMAC keys, and key material types
other than SYMMETRIC_DEFAULT are not supported.
It must be enabled and not pending deletion.
Its key policy must grant the CloudWatch service principal (cloudwatch.amazonaws.com)
these permissions: kms:DescribeKey, kms:GenerateDataKey, kms:Encrypt,
kms:Decrypt, and kms:ReEncrypt*. Amazon CloudWatch requires these permissions
to manage the data on your behalf.
The calling principal must have kms:Decrypt permission on the key.
It must be specified as a fully qualified key ARN. Key IDs, aliases, and alias ARNs are not accepted.
It must be in the same Amazon Web Services Region as the dataset.
Before completing the association, Amazon CloudWatch validates the key by performing
a series of dry-run KMS operations. Service-principal checks run first to verify that
the key policy grants the required access to Amazon CloudWatch. These checks include
kms:DescribeKey, kms:GenerateDataKey, kms:Encrypt, kms:Decrypt,
and kms:ReEncrypt*. After those succeed, a kms:Decrypt dry-run is run
with the caller's credentials to verify that the calling principal can use the new
key. When you are replacing an existing key, the caller's kms:Decrypt dry-run
is also run on the current key.
If any of these checks on the new key fails, the operation fails and the existing
key association (if any) remains unchanged. Common failure causes include the new
key being disabled, the key policy not granting the required permissions to Amazon
CloudWatch, or the caller lacking kms:Decrypt permission on the new key.
For more information about using customer managed keys with Amazon CloudWatch, see Encryption at rest with customer managed keys in the Amazon CloudWatch User Guide.
For .NET Core this operation is only available in asynchronous form. Please refer to AssociateDatasetKmsKeyAsync.
Namespace: Amazon.CloudWatch
Assembly: AWSSDK.CloudWatch.dll
Version: 3.x.y.z
public virtual AssociateDatasetKmsKeyResponse AssociateDatasetKmsKey( AssociateDatasetKmsKeyRequest request )
Container for the necessary parameters to execute the AssociateDatasetKmsKey service method.
| Exception | Condition |
|---|---|
| ConflictException | This operation attempted to create a resource that already exists. |
| KmsAccessDeniedException | The operation was denied because either the calling principal lacks the required Amazon Web Services Key Management Service (Amazon Web Services KMS) permission on the key, or the key policy does not grant Amazon CloudWatch the permissions it needs to use the key. Verify that the caller has kms:Decrypt permission on the key, and that the key policy grants the CloudWatch service principal the kms:DescribeKey, kms:GenerateDataKey, kms:Encrypt, kms:Decrypt, and kms:ReEncrypt* permissions described in AssociateDatasetKmsKey. |
| KmsKeyDisabledException | The specified Amazon Web Services Key Management Service (Amazon Web Services KMS) key is disabled or pending deletion. Re-enable the key (or restore it, if it is pending deletion) and retry the operation. |
| KmsKeyNotFoundException | The specified Amazon Web Services Key Management Service (Amazon Web Services KMS) key could not be found. Verify that the key Amazon Resource Name (ARN) is correct, that the key exists, and that it is in the same Amazon Web Services Region as the resource. |
| ResourceNotFoundException | The named resource does not exist. |
.NET Framework:
Supported in: 4.7.2 and newer