Jump to Content

New API Documentation - Developer Preview Available

We are excited to announce the developer preview of our new API documentation for AWS SDK for JavaScript v3. Please follow instructions on the landing page to leave us your feedback.

Class DisconnectCustomKeyStoreCommandProtected

Disconnects the custom key store from its backing key store. This operation disconnects an CloudHSM key store from its associated CloudHSM cluster or disconnects an external key store from the external key store proxy that communicates with your external key manager.

This operation is part of the custom key stores feature in KMS, which combines the convenience and extensive integration of KMS with the isolation and control of a key store that you own and manage.

While a custom key store is disconnected, you can manage the custom key store and its KMS keys, but you cannot create or use its KMS keys. You can reconnect the custom key store at any time.

While a custom key store is disconnected, all attempts to create KMS keys in the custom key store or to use existing KMS keys in cryptographic operations will fail. This action can prevent users from storing and accessing sensitive data.

When you disconnect a custom key store, its ConnectionState changes to Disconnected. To find the connection state of a custom key store, use the DescribeCustomKeyStores operation. To reconnect a custom key store, use the ConnectCustomKeyStore operation.

If the operation succeeds, it returns a JSON object with no properties.

Cross-account use: No. You cannot perform this operation on a custom key store in a different Amazon Web Services account.

Required permissions: kms:DisconnectCustomKeyStore (IAM policy)

Related operations:

Example

Use a bare-bones client and the command you need to make an API call.

import { KMSClient, DisconnectCustomKeyStoreCommand } from "@aws-sdk/client-kms"; // ES Modules import
// const { KMSClient, DisconnectCustomKeyStoreCommand } = require("@aws-sdk/client-kms"); // CommonJS import
const client = new KMSClient(config);
const input = { // DisconnectCustomKeyStoreRequest
CustomKeyStoreId: "STRING_VALUE", // required
};
const command = new DisconnectCustomKeyStoreCommand(input);
const response = await client.send(command);
// {};

Param

DisconnectCustomKeyStoreCommandInput

Returns

DisconnectCustomKeyStoreCommandOutput

See

Throws

CustomKeyStoreInvalidStateException (client fault)

The request was rejected because of the ConnectionState of the custom key store. To get the ConnectionState of a custom key store, use the DescribeCustomKeyStores operation.

This exception is thrown under the following conditions:

  • You requested the ConnectCustomKeyStore operation on a custom key store with a ConnectionState of DISCONNECTING or FAILED. This operation is valid for all other ConnectionState values. To reconnect a custom key store in a FAILED state, disconnect it (DisconnectCustomKeyStore), then connect it (ConnectCustomKeyStore).

  • You requested the CreateKey operation in a custom key store that is not connected. This operations is valid only when the custom key store ConnectionState is CONNECTED.

  • You requested the DisconnectCustomKeyStore operation on a custom key store with a ConnectionState of DISCONNECTING or DISCONNECTED. This operation is valid for all other ConnectionState values.

  • You requested the UpdateCustomKeyStore or DeleteCustomKeyStore operation on a custom key store that is not disconnected. This operation is valid only when the custom key store ConnectionState is DISCONNECTED.

  • You requested the GenerateRandom operation in an CloudHSM key store that is not connected. This operation is valid only when the CloudHSM key store ConnectionState is CONNECTED.

Throws

CustomKeyStoreNotFoundException (client fault)

The request was rejected because KMS cannot find a custom key store with the specified key store name or ID.

Throws

KMSInternalException (server fault)

The request was rejected because an internal exception occurred. The request can be retried.

Throws

KMSServiceException

Base exception class for all service exceptions from KMS service.

Example

To disconnect a custom key store from its CloudHSM cluster

// This example disconnects an AWS KMS custom key store from its backing key store. For an AWS CloudHSM key store, it disconnects the key store from its AWS CloudHSM cluster. For an external key store, it disconnects the key store from the external key store proxy that communicates with your external key manager. This operation doesn't return any data. To verify that the custom key store is disconnected, use the <code>DescribeCustomKeyStores</code> operation.
const input = {
"CustomKeyStoreId": "cks-1234567890abcdef0"
};
const command = new DisconnectCustomKeyStoreCommand(input);
await client.send(command);
// example id: to-disconnect-a-custom-key-store-from-its-cloudhsm-cluster-234abcdefABC

Hierarchy

Constructors

Properties

Methods