# DisassociateDatasetKmsKey
<a name="API_DisassociateDatasetKmsKey"></a>

Removes the customer managed Amazon Key Management Service (Amazon KMS) key association from the specified dataset. After this operation completes, data that you publish to the dataset is encrypted at rest using an Amazon owned key managed by Amazon CloudWatch.

Only the `default` dataset is supported. To call this operation, the dataset must currently have a customer managed KMS key associated with it. If the dataset has no associated KMS key, the operation fails with `ResourceNotFoundException`.

Amazon CloudWatch performs a dry-run `kms:Decrypt` call on the key as part of this operation. This verifies that the caller is authorized to use the currently associated key. The caller must have `kms:Decrypt` permission on the currently associated key, and the key must be enabled and accessible. If the key has been disabled or scheduled for deletion, you must first re-enable or restore it before you can disassociate it from the dataset.

**Important**  
Disassociating a KMS key from a dataset does not immediately remove the `kms:Decrypt` requirement on data plane operations. For up to three hours after disassociation, callers must continue to have `kms:Decrypt` permission on the previously associated key. Some data may still be encrypted with that key during this window. After this enforcement window elapses, the `kms:Decrypt` requirement is lifted.

For more information about using customer managed keys with Amazon CloudWatch, see [Encryption at rest with customer managed keys](https://docs.amazonaws.cn/AmazonCloudWatch/latest/monitoring/cmk-encryption.html) in the *Amazon CloudWatch User Guide*.

## Request Parameters
<a name="API_DisassociateDatasetKmsKey_RequestParameters"></a>

 ** DatasetIdentifier **   
Specifies the identifier of the dataset from which to remove the KMS key association. For the `default` dataset, you can specify either `default` or the full dataset Amazon Resource Name (ARN) in the format `arn:aws:cloudwatch:Region:account-id:dataset/default`.  
Type: String  
Length Constraints: Minimum length of 1. Maximum length of 2048.  
Pattern: `(default|arn:[a-zA-Z0-9-]+:cloudwatch:[a-zA-Z0-9-]*:\d{12}:dataset/default)`   
Required: Yes

## Errors
<a name="API_DisassociateDatasetKmsKey_Errors"></a>

For information about the errors that are common to all actions, see [Common Error Types](CommonErrors.md).

 ** ConflictException **   
This operation attempted to create a resource that already exists.  
HTTP Status Code: 409

 ** ResourceNotFoundException **   
The named resource does not exist.  
HTTP Status Code: 404

## See Also
<a name="API_DisassociateDatasetKmsKey_SeeAlso"></a>

For more information about using this API in one of the language-specific Amazon SDKs, see the following:
+  [Amazon Command Line Interface V2](https://docs.amazonaws.cn/goto/cli2/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for .NET V4](https://docs.amazonaws.cn/goto/DotNetSDKV4/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for C\+\+](https://docs.amazonaws.cn/goto/SdkForCpp/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for Go v2](https://docs.amazonaws.cn/goto/SdkForGoV2/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for Java V2](https://docs.amazonaws.cn/goto/SdkForJavaV2/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for JavaScript V3](https://docs.amazonaws.cn/goto/SdkForJavaScriptV3/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for Kotlin](https://docs.amazonaws.cn/goto/SdkForKotlin/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for PHP V3](https://docs.amazonaws.cn/goto/SdkForPHPV3/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for Python](https://docs.amazonaws.cn/goto/boto3/monitoring-2010-08-01/DisassociateDatasetKmsKey) 
+  [Amazon SDK for Ruby V3](https://docs.amazonaws.cn/goto/SdkForRubyV3/monitoring-2010-08-01/DisassociateDatasetKmsKey)