AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Removes the customer managed Amazon Web Services Key Management Service (Amazon Web Services KMS) key association from the specified dataset. After this operation completes, data that you publish to the dataset is encrypted at rest using an Amazon Web Services owned key managed by Amazon CloudWatch.
Only the default dataset is supported. To call this operation, the dataset
must currently have a customer managed KMS key associated with it. If the dataset
has no associated KMS key, the operation fails with ResourceNotFoundException.
Amazon CloudWatch performs a dry-run kms:Decrypt call on the key as part of
this operation. This verifies that the caller is authorized to use the currently associated
key. The caller must have kms:Decrypt permission on the currently associated
key, and the key must be enabled and accessible. If the key has been disabled or scheduled
for deletion, you must first re-enable or restore it before you can disassociate it
from the dataset.
Disassociating a KMS key from a dataset does not immediately remove the kms:Decrypt
requirement on data plane operations. For up to three hours after disassociation,
callers must continue to have kms:Decrypt permission on the previously associated
key. Some data may still be encrypted with that key during this window. After this
enforcement window elapses, the kms:Decrypt requirement is lifted.
For more information about using customer managed keys with Amazon CloudWatch, see Encryption at rest with customer managed keys in the Amazon CloudWatch User Guide.
This is an asynchronous operation using the standard naming convention for .NET 4.7.2 or higher.
Namespace: Amazon.CloudWatch
Assembly: AWSSDK.CloudWatch.dll
Version: 3.x.y.z
public abstract Task<DisassociateDatasetKmsKeyResponse> DisassociateDatasetKmsKeyAsync( DisassociateDatasetKmsKeyRequest request, CancellationToken cancellationToken )
Container for the necessary parameters to execute the DisassociateDatasetKmsKey service method.
A cancellation token that can be used by other objects or threads to receive notice of cancellation.
| Exception | Condition |
|---|---|
| ConflictException | This operation attempted to create a resource that already exists. |
| ResourceNotFoundException | The named resource does not exist. |
.NET:
Supported in: 8.0 and newer, Core 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.7.2 and newer