• The Amazon Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.amazonaws.cn/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). 

# Restricting decryption of `SecureString` parameter values
<a name="ps-restrict-decryption"></a>

A `SecureString` parameter value is encrypted with an Amazon KMS key. Any principal that retrieves the decrypted value must have `kms:Decrypt` permission on that key, whichever Parameter Store operation they call. This makes Amazon KMS key permissions an effective control for `SecureString` parameters, because a single Amazon KMS policy statement applies to all retrieval paths at once.

To use this control effectively, encrypt sensitive parameters with a customer managed key rather than the Amazon managed key.

**Important**  
The Amazon managed key for Parameter Store (`aws/ssm`) grants `Decrypt` permission to all IAM principals in the Amazon Web Services account. If you need different levels of access to `SecureString` parameters within an account, don't encrypt them with the default key.

For key policy examples, including how to deny access to the Amazon managed key and how to grant access to a customer managed key, see [Encrypting and decrypting parameters using Amazon KMS keys](parameter-store-setting-up.md#ps-kms-permissions).

**Note**  
Restricting `kms:Decrypt` prevents a principal from reading an encrypted *value*. It doesn't hide the parameter's name, description, or other metadata, which aren't encrypted, and it doesn't prevent the parameter from being listed. Use Parameter Store action denies as described in [Restricting access to specific parameters and paths](ps-restrict-parameter-access.md) to control those.