aws-sdk-cloudwatch 1.139.0 → 1.140.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 34f44e2737cc02c488467995def12d1dbeef3872d456ed5c93a42c5a8002d811
-  data.tar.gz: 8e30aa1f8353bd291c20a001f07045bc77c02ffa96d8883a27efa185861752f3
+  metadata.gz: 757903d0a14590e8a5b29e8e786811e98d4e9ee444bb83a173bff23a3643d18a
+  data.tar.gz: ea6e7efa72ebd26c537ef7ecc24028c934cda43f0010afe7bc750f6fb9089673
 SHA512:
-  metadata.gz: 0335dfbc92ae4b4c94c0e4d981026ef739d89de0271425dc7b44d32f40f47e13a5f285e16d25180f2e92b21ad34fa9f95ce8b2a9942f9cc7a5e441e144b1ea01
-  data.tar.gz: ed3ff883aff34427571b3850292b8defdd6f93da720d34e820383c5446c6f41e2f054c5256949356bcf31e780dbb272b6be95ec05d30db933e745d30ad254fdf
+  metadata.gz: 242d0143f4f1990be627456403aef91e8884a584cde8bc03577e423671168919c424112ee7fd1eabb30d19761f1841ba5685999ea280737272be24746fa8f6b4
+  data.tar.gz: 3fdf6143b7f052ab7b567e1ad7a3f7fe1508c9ffc019df4bf369e5b2fd2ccbf44da43e7ef97a94fef581358bfb75557159d5b9851f8e50181f28faa3982c1053

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.140.0 (2026-06-09)
+------------------
+
+* Feature - This release adds the APIs (AssociateDatasetKmsKey, DisassociateDatasetKmsKey, GetDataset) to manage encryption at rest for OpenTelemetry metrics in CloudWatch using AWS KMS customer managed keys.
+
 1.139.0 (2026-06-02)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.139.0
+1.140.0

data/lib/aws-sdk-cloudwatch/client.rb

@@ -481,6 +481,110 @@ module Aws::CloudWatch
 
     # @!group API Operations
 
+    # Associates an Amazon Web Services Key Management Service (Amazon Web
+    # Services KMS) customer managed key with the specified dataset. After
+    # this operation completes, all data published to the dataset is
+    # encrypted at rest using the specified KMS key. Callers must have
+    # `kms:Decrypt` permission on the key to read the encrypted data.
+    #
+    # Only the `default` dataset is supported. The `default` dataset is
+    # implicit for every account in every Region — you do not need to create
+    # it before calling this operation.
+    #
+    # You can call `AssociateDatasetKmsKey` on a dataset that is already
+    # associated with a KMS key to replace the existing key with a different
+    # one. To replace a key, the caller must have `kms:Decrypt` permission
+    # on both the current key and the new key.
+    #
+    # The KMS key that you specify must meet all of the following
+    # requirements:
+    #
+    # * It must be a symmetric encryption KMS key (key spec
+    #   `SYMMETRIC_DEFAULT`, key usage `ENCRYPT_DECRYPT`). Asymmetric keys,
+    #   HMAC keys, and key material types other than `SYMMETRIC_DEFAULT` are
+    #   not supported.
+    #
+    # * It must be enabled and not pending deletion.
+    #
+    # * Its key policy must grant the CloudWatch service principal
+    #   (`cloudwatch.amazonaws.com`) these permissions: `kms:DescribeKey`,
+    #   `kms:GenerateDataKey`, `kms:Encrypt`, `kms:Decrypt`, and
+    #   `kms:ReEncrypt*`. Amazon CloudWatch requires these permissions to
+    #   manage the data on your behalf.
+    #
+    # * The calling principal must have `kms:Decrypt` permission on the key.
+    #
+    # * It must be specified as a fully qualified key ARN. Key IDs, aliases,
+    #   and alias ARNs are not accepted.
+    #
+    # * It must be in the same Amazon Web Services Region as the dataset.
+    #
+    # Before completing the association, Amazon CloudWatch validates the key
+    # by performing a series of dry-run KMS operations. Service-principal
+    # checks run first to verify that the key policy grants the required
+    # access to Amazon CloudWatch. These checks include `kms:DescribeKey`,
+    # `kms:GenerateDataKey`, `kms:Encrypt`, `kms:Decrypt`, and
+    # `kms:ReEncrypt*`. After those succeed, a `kms:Decrypt` dry-run is run
+    # with the caller's credentials to verify that the calling principal
+    # can use the key. When you are replacing an existing key, the caller's
+    # `kms:Decrypt` dry-run is run on the current key first, and only then
+    # on the new key.
+    #
+    # If any of these checks fails, the operation fails and the existing key
+    # association (if any) remains unchanged. Common failure causes include
+    # the key being disabled, the key policy not granting the required
+    # permissions to Amazon CloudWatch, or the caller lacking `kms:Decrypt`
+    # permission on the key.
+    #
+    # For more information about using customer managed keys with Amazon
+    # CloudWatch, see [Encryption at rest with customer managed keys][1] in
+    # the *Amazon CloudWatch User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cmk-encryption.html
+    #
+    # @option params [required, String] :dataset_identifier
+    #   Specifies the identifier of the dataset that you want to associate the
+    #   KMS key with. For the `default` dataset, you can specify either
+    #   `default` or the full dataset Amazon Resource Name (ARN) in the format
+    #   `arn:aws:cloudwatch:Region:account-id:dataset/default`.
+    #
+    # @option params [required, String] :kms_key_arn
+    #   Specifies the Amazon Resource Name (ARN) of the customer managed KMS
+    #   key to associate with the dataset. The key must be a symmetric
+    #   encryption KMS key (`SYMMETRIC_DEFAULT`) in the same Amazon Web
+    #   Services Region as the dataset.
+    #
+    #   The ARN must be in the format
+    #   `arn:aws:kms:Region:account-id:key/key-id `. Key IDs, aliases, and
+    #   alias ARNs are not accepted.
+    #
+    #   For more information about KMS key ARNs, see [Key ARN][1] in the
+    #   *Amazon Web Services Key Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.associate_dataset_kms_key({
+    #     dataset_identifier: "DatasetIdentifier", # required
+    #     kms_key_arn: "KmsKeyArn", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/AssociateDatasetKmsKey AWS API Documentation
+    #
+    # @overload associate_dataset_kms_key(params = {})
+    # @param [Hash] params ({})
+    def associate_dataset_kms_key(params = {}, options = {})
+      req = build_request(:associate_dataset_kms_key, params)
+      req.send_request(options)
+    end
+
     # Deletes a specific alarm mute rule.
     #
     # When you delete a mute rule, any alarms that are currently being muted
@@ -1467,6 +1571,63 @@ module Aws::CloudWatch
       req.send_request(options)
     end
 
+    # Removes the customer managed Amazon Web Services Key Management
+    # Service (Amazon Web Services KMS) key association from the specified
+    # dataset. After this operation completes, data that you publish to the
+    # dataset is encrypted at rest using an Amazon Web Services owned key
+    # managed by Amazon CloudWatch.
+    #
+    # Only the `default` dataset is supported. To call this operation, the
+    # dataset must currently have a customer managed KMS key associated with
+    # it. If the dataset has no associated KMS key, the operation fails with
+    # `ResourceNotFoundException`.
+    #
+    # Amazon CloudWatch performs a dry-run `kms:Decrypt` call on the key as
+    # part of this operation. This verifies that the caller is authorized to
+    # use the currently associated key. The caller must have `kms:Decrypt`
+    # permission on the currently associated key, and the key must be
+    # enabled and accessible. If the key has been disabled or scheduled for
+    # deletion, you must first re-enable or restore it before you can
+    # disassociate it from the dataset.
+    #
+    # Disassociating a KMS key from a dataset does not immediately remove
+    # the `kms:Decrypt` requirement on data plane operations. For up to
+    # three hours after disassociation, callers must continue to have
+    # `kms:Decrypt` permission on the previously associated key. Some data
+    # may still be encrypted with that key during this window. After this
+    # enforcement window elapses, the `kms:Decrypt` requirement is lifted.
+    #
+    # For more information about using customer managed keys with Amazon
+    # CloudWatch, see [Encryption at rest with customer managed keys][1] in
+    # the *Amazon CloudWatch User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cmk-encryption.html
+    #
+    # @option params [required, String] :dataset_identifier
+    #   Specifies the identifier of the dataset from which to remove the KMS
+    #   key association. For the `default` dataset, you can specify either
+    #   `default` or the full dataset Amazon Resource Name (ARN) in the format
+    #   `arn:aws:cloudwatch:Region:account-id:dataset/default`.
+    #
+    # @return [Struct] Returns an empty {Seahorse::Client::Response response}.
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.disassociate_dataset_kms_key({
+    #     dataset_identifier: "DatasetIdentifier", # required
+    #   })
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/DisassociateDatasetKmsKey AWS API Documentation
+    #
+    # @overload disassociate_dataset_kms_key(params = {})
+    # @param [Hash] params ({})
+    def disassociate_dataset_kms_key(params = {}, options = {})
+      req = build_request(:disassociate_dataset_kms_key, params)
+      req.send_request(options)
+    end
+
     # Enables the actions for the specified alarms.
     #
     # @option params [required, Array<String>] :alarm_names
@@ -1636,6 +1797,60 @@ module Aws::CloudWatch
       req.send_request(options)
     end
 
+    # Returns information about the specified dataset. This includes its
+    # identifier, Amazon Resource Name (ARN), and any customer managed
+    # Amazon Web Services Key Management Service (Amazon Web Services KMS)
+    # key that is currently associated with it.
+    #
+    # Only the `default` dataset is supported. The `default` dataset is
+    # implicit for every account in every Region — you can call `GetDataset`
+    # for it without first creating it. If no customer managed KMS key has
+    # been associated with the dataset, the response omits the `KmsKeyArn`
+    # field, indicating that data is encrypted at rest using an Amazon Web
+    # Services owned key managed by Amazon CloudWatch.
+    #
+    # To associate a customer managed KMS key with a dataset, use
+    # [AssociateDatasetKmsKey][1]. To remove the association, use
+    # [DisassociateDatasetKmsKey][2].
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_AssociateDatasetKmsKey.html
+    # [2]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisassociateDatasetKmsKey.html
+    #
+    # @option params [required, String] :dataset_identifier
+    #   Specifies the identifier of the dataset to retrieve. For the `default`
+    #   dataset, you can specify either `default` or the full dataset Amazon
+    #   Resource Name (ARN) in the format
+    #   `arn:aws:cloudwatch:Region:account-id:dataset/default`.
+    #
+    # @return [Types::GetDatasetOutput] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetDatasetOutput#dataset_id #dataset_id} => String
+    #   * {Types::GetDatasetOutput#arn #arn} => String
+    #   * {Types::GetDatasetOutput#kms_key_arn #kms_key_arn} => String
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_dataset({
+    #     dataset_identifier: "DatasetIdentifier", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.dataset_id #=> String
+    #   resp.arn #=> String
+    #   resp.kms_key_arn #=> String
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/GetDataset AWS API Documentation
+    #
+    # @overload get_dataset(params = {})
+    # @param [Hash] params ({})
+    def get_dataset(params = {}, options = {})
+      req = build_request(:get_dataset, params)
+      req.send_request(options)
+    end
+
     # This operation returns the time series data collected by a Contributor
     # Insights rule. The data includes the identity and number of
     # contributors to the log group.
@@ -4846,7 +5061,7 @@ module Aws::CloudWatch
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-cloudwatch'
-      context[:gem_version] = '1.139.0'
+      context[:gem_version] = '1.140.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-cloudwatch/client_api.rb

@@ -47,6 +47,8 @@ module Aws::CloudWatch
     AnomalyDetectorTypes = Shapes::ListShape.new(name: 'AnomalyDetectorTypes')
     AnomalyDetectors = Shapes::ListShape.new(name: 'AnomalyDetectors')
     Arn = Shapes::StringShape.new(name: 'Arn')
+    AssociateDatasetKmsKeyInput = Shapes::StructureShape.new(name: 'AssociateDatasetKmsKeyInput')
+    AssociateDatasetKmsKeyOutput = Shapes::StructureShape.new(name: 'AssociateDatasetKmsKeyOutput')
     AttributeName = Shapes::StringShape.new(name: 'AttributeName')
     AttributeValue = Shapes::StringShape.new(name: 'AttributeValue')
     AwsQueryErrorMessage = Shapes::StringShape.new(name: 'AwsQueryErrorMessage')
@@ -78,6 +80,9 @@ module Aws::CloudWatch
     DatapointValues = Shapes::ListShape.new(name: 'DatapointValues')
     Datapoints = Shapes::ListShape.new(name: 'Datapoints')
     DatapointsToAlarm = Shapes::IntegerShape.new(name: 'DatapointsToAlarm')
+    DatasetArn = Shapes::StringShape.new(name: 'DatasetArn')
+    DatasetId = Shapes::StringShape.new(name: 'DatasetId')
+    DatasetIdentifier = Shapes::StringShape.new(name: 'DatasetIdentifier')
     DeleteAlarmMuteRuleInput = Shapes::StructureShape.new(name: 'DeleteAlarmMuteRuleInput')
     DeleteAlarmsInput = Shapes::StructureShape.new(name: 'DeleteAlarmsInput')
     DeleteAnomalyDetectorInput = Shapes::StructureShape.new(name: 'DeleteAnomalyDetectorInput')
@@ -109,6 +114,8 @@ module Aws::CloudWatch
     DisableAlarmActionsInput = Shapes::StructureShape.new(name: 'DisableAlarmActionsInput')
     DisableInsightRulesInput = Shapes::StructureShape.new(name: 'DisableInsightRulesInput')
     DisableInsightRulesOutput = Shapes::StructureShape.new(name: 'DisableInsightRulesOutput')
+    DisassociateDatasetKmsKeyInput = Shapes::StructureShape.new(name: 'DisassociateDatasetKmsKeyInput')
+    DisassociateDatasetKmsKeyOutput = Shapes::StructureShape.new(name: 'DisassociateDatasetKmsKeyOutput')
     Duration = Shapes::StringShape.new(name: 'Duration')
     EnableAlarmActionsInput = Shapes::StructureShape.new(name: 'EnableAlarmActionsInput')
     EnableInsightRulesInput = Shapes::StructureShape.new(name: 'EnableInsightRulesInput')
@@ -140,6 +147,8 @@ module Aws::CloudWatch
     GetAlarmMuteRuleOutput = Shapes::StructureShape.new(name: 'GetAlarmMuteRuleOutput')
     GetDashboardInput = Shapes::StructureShape.new(name: 'GetDashboardInput')
     GetDashboardOutput = Shapes::StructureShape.new(name: 'GetDashboardOutput')
+    GetDatasetInput = Shapes::StructureShape.new(name: 'GetDatasetInput')
+    GetDatasetOutput = Shapes::StructureShape.new(name: 'GetDatasetOutput')
     GetInsightRuleReportInput = Shapes::StructureShape.new(name: 'GetInsightRuleReportInput')
     GetInsightRuleReportOutput = Shapes::StructureShape.new(name: 'GetInsightRuleReportOutput')
     GetMetricDataInput = Shapes::StructureShape.new(name: 'GetMetricDataInput')
@@ -191,6 +200,10 @@ module Aws::CloudWatch
     InvalidNextToken = Shapes::StructureShape.new(name: 'InvalidNextToken', error: {"code" => "InvalidNextToken", "httpStatusCode" => 400, "senderFault" => true})
     InvalidParameterCombinationException = Shapes::StructureShape.new(name: 'InvalidParameterCombinationException', error: {"code" => "InvalidParameterCombination", "httpStatusCode" => 400, "senderFault" => true})
     InvalidParameterValueException = Shapes::StructureShape.new(name: 'InvalidParameterValueException', error: {"code" => "InvalidParameterValue", "httpStatusCode" => 400, "senderFault" => true})
+    KmsAccessDeniedException = Shapes::StructureShape.new(name: 'KmsAccessDeniedException')
+    KmsKeyArn = Shapes::StringShape.new(name: 'KmsKeyArn')
+    KmsKeyDisabledException = Shapes::StructureShape.new(name: 'KmsKeyDisabledException')
+    KmsKeyNotFoundException = Shapes::StructureShape.new(name: 'KmsKeyNotFoundException')
     LabelOptions = Shapes::StructureShape.new(name: 'LabelOptions')
     LastModified = Shapes::TimestampShape.new(name: 'LastModified')
     LimitExceededException = Shapes::StructureShape.new(name: 'LimitExceededException', error: {"code" => "LimitExceededException", "httpStatusCode" => 400, "senderFault" => true})
@@ -318,6 +331,7 @@ module Aws::CloudWatch
     StopOTelEnrichmentOutput = Shapes::StructureShape.new(name: 'StopOTelEnrichmentOutput')
     StorageResolution = Shapes::IntegerShape.new(name: 'StorageResolution')
     StrictEntityValidation = Shapes::BooleanShape.new(name: 'StrictEntityValidation')
+    String = Shapes::StringShape.new(name: 'String')
     SuppressorPeriod = Shapes::IntegerShape.new(name: 'SuppressorPeriod')
     Tag = Shapes::StructureShape.new(name: 'Tag')
     TagKey = Shapes::StringShape.new(name: 'TagKey')
@@ -397,6 +411,12 @@ module Aws::CloudWatch
 
     AnomalyDetectors.member = Shapes::ShapeRef.new(shape: AnomalyDetector)
 
+    AssociateDatasetKmsKeyInput.add_member(:dataset_identifier, Shapes::ShapeRef.new(shape: DatasetIdentifier, required: true, location_name: "DatasetIdentifier"))
+    AssociateDatasetKmsKeyInput.add_member(:kms_key_arn, Shapes::ShapeRef.new(shape: KmsKeyArn, required: true, location_name: "KmsKeyArn"))
+    AssociateDatasetKmsKeyInput.struct_class = Types::AssociateDatasetKmsKeyInput
+
+    AssociateDatasetKmsKeyOutput.struct_class = Types::AssociateDatasetKmsKeyOutput
+
     BatchFailures.member = Shapes::ShapeRef.new(shape: PartialFailure)
 
     CompositeAlarm.add_member(:actions_enabled, Shapes::ShapeRef.new(shape: ActionsEnabled, location_name: "ActionsEnabled"))
@@ -596,6 +616,11 @@ module Aws::CloudWatch
     DisableInsightRulesOutput.add_member(:failures, Shapes::ShapeRef.new(shape: BatchFailures, location_name: "Failures"))
     DisableInsightRulesOutput.struct_class = Types::DisableInsightRulesOutput
 
+    DisassociateDatasetKmsKeyInput.add_member(:dataset_identifier, Shapes::ShapeRef.new(shape: DatasetIdentifier, required: true, location_name: "DatasetIdentifier"))
+    DisassociateDatasetKmsKeyInput.struct_class = Types::DisassociateDatasetKmsKeyInput
+
+    DisassociateDatasetKmsKeyOutput.struct_class = Types::DisassociateDatasetKmsKeyOutput
+
     EnableAlarmActionsInput.add_member(:alarm_names, Shapes::ShapeRef.new(shape: AlarmNames, required: true, location_name: "AlarmNames"))
     EnableAlarmActionsInput.struct_class = Types::EnableAlarmActionsInput
 
@@ -652,6 +677,14 @@ module Aws::CloudWatch
     GetDashboardOutput.add_member(:dashboard_name, Shapes::ShapeRef.new(shape: DashboardName, location_name: "DashboardName"))
     GetDashboardOutput.struct_class = Types::GetDashboardOutput
 
+    GetDatasetInput.add_member(:dataset_identifier, Shapes::ShapeRef.new(shape: DatasetIdentifier, required: true, location_name: "DatasetIdentifier"))
+    GetDatasetInput.struct_class = Types::GetDatasetInput
+
+    GetDatasetOutput.add_member(:dataset_id, Shapes::ShapeRef.new(shape: DatasetId, required: true, location_name: "DatasetId"))
+    GetDatasetOutput.add_member(:arn, Shapes::ShapeRef.new(shape: DatasetArn, required: true, location_name: "Arn"))
+    GetDatasetOutput.add_member(:kms_key_arn, Shapes::ShapeRef.new(shape: KmsKeyArn, location_name: "KmsKeyArn"))
+    GetDatasetOutput.struct_class = Types::GetDatasetOutput
+
     GetInsightRuleReportInput.add_member(:rule_name, Shapes::ShapeRef.new(shape: InsightRuleName, required: true, location_name: "RuleName"))
     GetInsightRuleReportInput.add_member(:start_time, Shapes::ShapeRef.new(shape: Timestamp, required: true, location_name: "StartTime"))
     GetInsightRuleReportInput.add_member(:end_time, Shapes::ShapeRef.new(shape: Timestamp, required: true, location_name: "EndTime"))
@@ -785,6 +818,15 @@ module Aws::CloudWatch
     InvalidParameterValueException.add_member(:message, Shapes::ShapeRef.new(shape: AwsQueryErrorMessage, location_name: "message"))
     InvalidParameterValueException.struct_class = Types::InvalidParameterValueException
 
+    KmsAccessDeniedException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "Message"))
+    KmsAccessDeniedException.struct_class = Types::KmsAccessDeniedException
+
+    KmsKeyDisabledException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "Message"))
+    KmsKeyDisabledException.struct_class = Types::KmsKeyDisabledException
+
+    KmsKeyNotFoundException.add_member(:message, Shapes::ShapeRef.new(shape: String, required: true, location_name: "Message"))
+    KmsKeyNotFoundException.struct_class = Types::KmsKeyNotFoundException
+
     LabelOptions.add_member(:timezone, Shapes::ShapeRef.new(shape: GetMetricDataLabelTimezone, location_name: "Timezone"))
     LabelOptions.struct_class = Types::LabelOptions
 
@@ -1221,6 +1263,19 @@ module Aws::CloudWatch
         "xmlNamespace" => "http://monitoring.amazonaws.com/doc/2010-08-01/",
       }
 
+      api.add_operation(:associate_dataset_kms_key, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "AssociateDatasetKmsKey"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: AssociateDatasetKmsKeyInput)
+        o.output = Shapes::ShapeRef.new(shape: AssociateDatasetKmsKeyOutput)
+        o.errors << Shapes::ShapeRef.new(shape: KmsAccessDeniedException)
+        o.errors << Shapes::ShapeRef.new(shape: KmsKeyNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
+        o.errors << Shapes::ShapeRef.new(shape: KmsKeyDisabledException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+      end)
+
       api.add_operation(:delete_alarm_mute_rule, Seahorse::Model::Operation.new.tap do |o|
         o.name = "DeleteAlarmMuteRule"
         o.http_method = "POST"
@@ -1382,6 +1437,16 @@ module Aws::CloudWatch
         o.errors << Shapes::ShapeRef.new(shape: MissingRequiredParameterException)
       end)
 
+      api.add_operation(:disassociate_dataset_kms_key, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "DisassociateDatasetKmsKey"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: DisassociateDatasetKmsKeyInput)
+        o.output = Shapes::ShapeRef.new(shape: DisassociateDatasetKmsKeyOutput)
+        o.errors << Shapes::ShapeRef.new(shape: ConflictException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+      end)
+
       api.add_operation(:enable_alarm_actions, Seahorse::Model::Operation.new.tap do |o|
         o.name = "EnableAlarmActions"
         o.http_method = "POST"
@@ -1421,6 +1486,15 @@ module Aws::CloudWatch
         o.errors << Shapes::ShapeRef.new(shape: InternalServiceFault)
       end)
 
+      api.add_operation(:get_dataset, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "GetDataset"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: GetDatasetInput)
+        o.output = Shapes::ShapeRef.new(shape: GetDatasetOutput)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+      end)
+
       api.add_operation(:get_insight_rule_report, Seahorse::Model::Operation.new.tap do |o|
         o.name = "GetInsightRuleReport"
         o.http_method = "POST"

data/lib/aws-sdk-cloudwatch/errors.rb

@@ -42,6 +42,9 @@ module Aws::CloudWatch
   #    * This error class is not used. `InvalidParameterCombination` is used during parsing instead.
   # * {InvalidParameterValueException}
   #    * This error class is not used. `InvalidParameterValue` is used during parsing instead.
+  # * {KmsAccessDeniedException}
+  # * {KmsKeyDisabledException}
+  # * {KmsKeyNotFoundException}
   # * {LimitExceededException}
   # * {LimitExceededFault}
   #    * This error class is not used. `LimitExceeded` is used during parsing instead.
@@ -203,6 +206,51 @@ module Aws::CloudWatch
       end
     end
 
+    class KmsAccessDeniedException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::CloudWatch::Types::KmsAccessDeniedException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
+    class KmsKeyDisabledException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::CloudWatch::Types::KmsKeyDisabledException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
+    class KmsKeyNotFoundException < ServiceError
+
+      # @param [Seahorse::Client::RequestContext] context
+      # @param [String] message
+      # @param [Aws::CloudWatch::Types::KmsKeyNotFoundException] data
+      def initialize(context, message, data = Aws::EmptyStructure.new)
+        super(context, message, data)
+      end
+
+      # @return [String]
+      def message
+        @message || @data[:message]
+      end
+    end
+
     class LimitExceededException < ServiceError
 
       # @param [Seahorse::Client::RequestContext] context

data/lib/aws-sdk-cloudwatch/types.rb

@@ -265,6 +265,44 @@ module Aws::CloudWatch
       include Aws::Structure
     end
 
+    # @!attribute [rw] dataset_identifier
+    #   Specifies the identifier of the dataset that you want to associate
+    #   the KMS key with. For the `default` dataset, you can specify either
+    #   `default` or the full dataset Amazon Resource Name (ARN) in the
+    #   format `arn:aws:cloudwatch:Region:account-id:dataset/default`.
+    #   @return [String]
+    #
+    # @!attribute [rw] kms_key_arn
+    #   Specifies the Amazon Resource Name (ARN) of the customer managed KMS
+    #   key to associate with the dataset. The key must be a symmetric
+    #   encryption KMS key (`SYMMETRIC_DEFAULT`) in the same Amazon Web
+    #   Services Region as the dataset.
+    #
+    #   The ARN must be in the format
+    #   `arn:aws:kms:Region:account-id:key/key-id `. Key IDs, aliases, and
+    #   alias ARNs are not accepted.
+    #
+    #   For more information about KMS key ARNs, see [Key ARN][1] in the
+    #   *Amazon Web Services Key Management Service Developer Guide*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/AssociateDatasetKmsKeyInput AWS API Documentation
+    #
+    class AssociateDatasetKmsKeyInput < Struct.new(
+      :dataset_identifier,
+      :kms_key_arn)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/AssociateDatasetKmsKeyOutput AWS API Documentation
+    #
+    class AssociateDatasetKmsKeyOutput < Aws::EmptyStructure; end
+
     # The details about a composite alarm.
     #
     # @!attribute [rw] actions_enabled
@@ -1215,6 +1253,25 @@ module Aws::CloudWatch
       include Aws::Structure
     end
 
+    # @!attribute [rw] dataset_identifier
+    #   Specifies the identifier of the dataset from which to remove the KMS
+    #   key association. For the `default` dataset, you can specify either
+    #   `default` or the full dataset Amazon Resource Name (ARN) in the
+    #   format `arn:aws:cloudwatch:Region:account-id:dataset/default`.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/DisassociateDatasetKmsKeyInput AWS API Documentation
+    #
+    class DisassociateDatasetKmsKeyInput < Struct.new(
+      :dataset_identifier)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/DisassociateDatasetKmsKeyOutput AWS API Documentation
+    #
+    class DisassociateDatasetKmsKeyOutput < Aws::EmptyStructure; end
+
     # @!attribute [rw] alarm_names
     #   The names of the alarms.
     #   @return [Array<String>]
@@ -1462,6 +1519,48 @@ module Aws::CloudWatch
       include Aws::Structure
     end
 
+    # @!attribute [rw] dataset_identifier
+    #   Specifies the identifier of the dataset to retrieve. For the
+    #   `default` dataset, you can specify either `default` or the full
+    #   dataset Amazon Resource Name (ARN) in the format
+    #   `arn:aws:cloudwatch:Region:account-id:dataset/default`.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/GetDatasetInput AWS API Documentation
+    #
+    class GetDatasetInput < Struct.new(
+      :dataset_identifier)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] dataset_id
+    #   Returns the identifier of the dataset.
+    #   @return [String]
+    #
+    # @!attribute [rw] arn
+    #   Returns the Amazon Resource Name (ARN) of the dataset, in the format
+    #   `arn:aws:cloudwatch:Region:account-id:dataset/dataset-id `.
+    #   @return [String]
+    #
+    # @!attribute [rw] kms_key_arn
+    #   Returns the Amazon Resource Name (ARN) of the customer managed
+    #   Amazon Web Services KMS key that is currently associated with the
+    #   dataset, if any. If the dataset is not associated with a customer
+    #   managed KMS key, this field is not included in the response and the
+    #   dataset is encrypted at rest using an Amazon Web Services owned key.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/GetDatasetOutput AWS API Documentation
+    #
+    class GetDatasetOutput < Struct.new(
+      :dataset_id,
+      :arn,
+      :kms_key_arn)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] rule_name
     #   The name of the rule that you want to see data from.
     #   @return [String]
@@ -2341,6 +2440,61 @@ module Aws::CloudWatch
       include Aws::Structure
     end
 
+    # The operation was denied because either the calling principal lacks
+    # the required Amazon Web Services Key Management Service (Amazon Web
+    # Services KMS) permission on the key, or the key policy does not grant
+    # Amazon CloudWatch the permissions it needs to use the key. Verify that
+    # the caller has `kms:Decrypt` permission on the key, and that the key
+    # policy grants the CloudWatch service principal the `kms:DescribeKey`,
+    # `kms:GenerateDataKey`, `kms:Encrypt`, `kms:Decrypt`, and
+    # `kms:ReEncrypt*` permissions described in [AssociateDatasetKmsKey][1].
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_AssociateDatasetKmsKey.html
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/KmsAccessDeniedException AWS API Documentation
+    #
+    class KmsAccessDeniedException < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The specified Amazon Web Services Key Management Service (Amazon Web
+    # Services KMS) key is disabled or pending deletion. Re-enable the key
+    # (or restore it, if it is pending deletion) and retry the operation.
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/KmsKeyDisabledException AWS API Documentation
+    #
+    class KmsKeyDisabledException < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The specified Amazon Web Services Key Management Service (Amazon Web
+    # Services KMS) key could not be found. Verify that the key Amazon
+    # Resource Name (ARN) is correct, that the key exists, and that it is in
+    # the same Amazon Web Services Region as the resource.
+    #
+    # @!attribute [rw] message
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/monitoring-2010-08-01/KmsKeyNotFoundException AWS API Documentation
+    #
+    class KmsKeyNotFoundException < Struct.new(
+      :message)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # This structure includes the `Timezone` parameter, which you can use to
     # specify your time zone so that the labels that are associated with
     # returned metrics display the correct time for your time zone.

data/lib/aws-sdk-cloudwatch.rb

@@ -23,7 +23,7 @@ Aws::Plugins::GlobalConfiguration.add_identifier(:cloudwatch)
 # structure.
 #
 #     cloud_watch = Aws::CloudWatch::Client.new
-#     resp = cloud_watch.delete_alarm_mute_rule(params)
+#     resp = cloud_watch.associate_dataset_kms_key(params)
 #
 # See {Client} for more information.
 #
@@ -58,7 +58,7 @@ module Aws::CloudWatch
   autoload :CompositeAlarm, 'aws-sdk-cloudwatch/composite_alarm'
   autoload :Metric, 'aws-sdk-cloudwatch/metric'
 
-  GEM_VERSION = '1.139.0'
+  GEM_VERSION = '1.140.0'
 
 end
 

data/sig/client.rbs

@@ -79,6 +79,16 @@ module Aws
                   | (?Hash[Symbol, untyped]) -> instance
 
 
+      interface _AssociateDatasetKmsKeyResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::AssociateDatasetKmsKeyOutput]
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatch/Client.html#associate_dataset_kms_key-instance_method
+      def associate_dataset_kms_key: (
+                                       dataset_identifier: ::String,
+                                       kms_key_arn: ::String
+                                     ) -> _AssociateDatasetKmsKeyResponseSuccess
+                                   | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _AssociateDatasetKmsKeyResponseSuccess
+
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatch/Client.html#delete_alarm_mute_rule-instance_method
       def delete_alarm_mute_rule: (
                                     alarm_mute_rule_name: ::String
@@ -259,6 +269,15 @@ module Aws
                                  ) -> _DisableInsightRulesResponseSuccess
                                | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DisableInsightRulesResponseSuccess
 
+      interface _DisassociateDatasetKmsKeyResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::DisassociateDatasetKmsKeyOutput]
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatch/Client.html#disassociate_dataset_kms_key-instance_method
+      def disassociate_dataset_kms_key: (
+                                          dataset_identifier: ::String
+                                        ) -> _DisassociateDatasetKmsKeyResponseSuccess
+                                      | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _DisassociateDatasetKmsKeyResponseSuccess
+
       # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatch/Client.html#enable_alarm_actions-instance_method
       def enable_alarm_actions: (
                                   alarm_names: Array[::String]
@@ -306,6 +325,18 @@ module Aws
                          ) -> _GetDashboardResponseSuccess
                        | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetDashboardResponseSuccess
 
+      interface _GetDatasetResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::GetDatasetOutput]
+        def dataset_id: () -> ::String
+        def arn: () -> ::String
+        def kms_key_arn: () -> ::String
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/CloudWatch/Client.html#get_dataset-instance_method
+      def get_dataset: (
+                         dataset_identifier: ::String
+                       ) -> _GetDatasetResponseSuccess
+                     | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetDatasetResponseSuccess
+
       interface _GetInsightRuleReportResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::GetInsightRuleReportOutput]
         def key_labels: () -> ::Array[::String]

data/sig/errors.rbs

@@ -38,6 +38,15 @@ module Aws
       class InvalidParameterValueException < ::Aws::Errors::ServiceError
         def message: () -> ::String
       end
+      class KmsAccessDeniedException < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
+      class KmsKeyDisabledException < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
+      class KmsKeyNotFoundException < ::Aws::Errors::ServiceError
+        def message: () -> ::String
+      end
       class LimitExceededException < ::Aws::Errors::ServiceError
       end
       class LimitExceededFault < ::Aws::Errors::ServiceError

data/sig/types.rbs

@@ -63,6 +63,15 @@ module Aws::CloudWatch
       SENSITIVE: []
     end
 
+    class AssociateDatasetKmsKeyInput
+      attr_accessor dataset_identifier: ::String
+      attr_accessor kms_key_arn: ::String
+      SENSITIVE: []
+    end
+
+    class AssociateDatasetKmsKeyOutput < Aws::EmptyStructure
+    end
+
     class CompositeAlarm
       attr_accessor actions_enabled: bool
       attr_accessor alarm_actions: ::Array[::String]
@@ -302,6 +311,14 @@ module Aws::CloudWatch
       SENSITIVE: []
     end
 
+    class DisassociateDatasetKmsKeyInput
+      attr_accessor dataset_identifier: ::String
+      SENSITIVE: []
+    end
+
+    class DisassociateDatasetKmsKeyOutput < Aws::EmptyStructure
+    end
+
     class EnableAlarmActionsInput
       attr_accessor alarm_names: ::Array[::String]
       SENSITIVE: []
@@ -371,6 +388,18 @@ module Aws::CloudWatch
       SENSITIVE: []
     end
 
+    class GetDatasetInput
+      attr_accessor dataset_identifier: ::String
+      SENSITIVE: []
+    end
+
+    class GetDatasetOutput
+      attr_accessor dataset_id: ::String
+      attr_accessor arn: ::String
+      attr_accessor kms_key_arn: ::String
+      SENSITIVE: []
+    end
+
     class GetInsightRuleReportInput
       attr_accessor rule_name: ::String
       attr_accessor start_time: ::Time
@@ -529,6 +558,21 @@ module Aws::CloudWatch
       SENSITIVE: []
     end
 
+    class KmsAccessDeniedException
+      attr_accessor message: ::String
+      SENSITIVE: []
+    end
+
+    class KmsKeyDisabledException
+      attr_accessor message: ::String
+      SENSITIVE: []
+    end
+
+    class KmsKeyNotFoundException
+      attr_accessor message: ::String
+      SENSITIVE: []
+    end
+
     class LabelOptions
       attr_accessor timezone: ::String
       SENSITIVE: []

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-cloudwatch
 version: !ruby/object:Gem::Version
-  version: 1.139.0
+  version: 1.140.0
 platform: ruby
 authors:
 - Amazon Web Services