@cdklabs/cdk-ssm-documents 0.0.64 → 0.0.66

package/node_modules/@aws-sdk/client-cloudwatch/dist-types/commands/AssociateDatasetKmsKeyCommand.d.ts

@@ -0,0 +1,161 @@
+import { Command as $Command } from "@smithy/core/client";
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CloudWatchClient";
+import type { AssociateDatasetKmsKeyInput, AssociateDatasetKmsKeyOutput } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+export { $Command };
+/**
+ * @public
+ *
+ * The input for {@link AssociateDatasetKmsKeyCommand}.
+ */
+export interface AssociateDatasetKmsKeyCommandInput extends AssociateDatasetKmsKeyInput {
+}
+/**
+ * @public
+ *
+ * The output of {@link AssociateDatasetKmsKeyCommand}.
+ */
+export interface AssociateDatasetKmsKeyCommandOutput extends AssociateDatasetKmsKeyOutput, __MetadataBearer {
+}
+declare const AssociateDatasetKmsKeyCommand_base: {
+    new (input: AssociateDatasetKmsKeyCommandInput): import("@smithy/core/client").CommandImpl<AssociateDatasetKmsKeyCommandInput, AssociateDatasetKmsKeyCommandOutput, CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    new (input: AssociateDatasetKmsKeyCommandInput): import("@smithy/core/client").CommandImpl<AssociateDatasetKmsKeyCommandInput, AssociateDatasetKmsKeyCommandOutput, CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    getEndpointParameterInstructions(): {
+        [x: string]: unknown;
+    };
+};
+/**
+ * <p>Associates an Amazon Web Services Key Management Service (Amazon Web Services KMS)
+ *             customer managed key with the specified dataset. After this operation completes, all
+ *             data published to the dataset is encrypted at rest using the specified KMS key.
+ *             Callers must have <code>kms:Decrypt</code> permission on the key to read the
+ *             encrypted data.</p>
+ *          <p>Only the <code>default</code> dataset is supported. The <code>default</code> dataset
+ *             is implicit for every account in every Region — you do not need to create it before
+ *             calling this operation.</p>
+ *          <p>You can call <code>AssociateDatasetKmsKey</code> on a dataset that is already
+ *             associated with a KMS key to replace the existing key with a different one. To replace
+ *             a key, the caller must have <code>kms:Decrypt</code> permission on both the current
+ *             key and the new key.</p>
+ *          <p>The KMS key that you specify must meet all of the following requirements:</p>
+ *          <ul>
+ *             <li>
+ *                <p>It must be a symmetric encryption KMS key (key spec
+ *                     <code>SYMMETRIC_DEFAULT</code>, key usage <code>ENCRYPT_DECRYPT</code>).
+ *                     Asymmetric keys, HMAC keys, and key material types other than
+ *                     <code>SYMMETRIC_DEFAULT</code> are not supported.</p>
+ *             </li>
+ *             <li>
+ *                <p>It must be enabled and not pending deletion.</p>
+ *             </li>
+ *             <li>
+ *                <p>Its key policy must grant the CloudWatch service principal
+ *                     (<code>cloudwatch.amazonaws.com</code>) these permissions:
+ *                     <code>kms:DescribeKey</code>, <code>kms:GenerateDataKey</code>,
+ *                     <code>kms:Encrypt</code>, <code>kms:Decrypt</code>, and
+ *                     <code>kms:ReEncrypt*</code>. Amazon CloudWatch requires these permissions
+ *                     to manage the data on your behalf.</p>
+ *             </li>
+ *             <li>
+ *                <p>The calling principal must have <code>kms:Decrypt</code> permission on the
+ *                     key.</p>
+ *             </li>
+ *             <li>
+ *                <p>It must be specified as a fully qualified key ARN. Key IDs, aliases, and
+ *                     alias ARNs are not accepted.</p>
+ *             </li>
+ *             <li>
+ *                <p>It must be in the same Amazon Web Services Region as the dataset.</p>
+ *             </li>
+ *          </ul>
+ *          <p>Before completing the association, Amazon CloudWatch validates the key by
+ *             performing a series of dry-run KMS operations. Service-principal checks run first to
+ *             verify that the key policy grants the required access to Amazon CloudWatch. These
+ *             checks include <code>kms:DescribeKey</code>, <code>kms:GenerateDataKey</code>,
+ *             <code>kms:Encrypt</code>, <code>kms:Decrypt</code>, and <code>kms:ReEncrypt*</code>.
+ *             After those succeed, a <code>kms:Decrypt</code> dry-run is run with the caller's
+ *             credentials to verify that the calling principal can use the key. When you are
+ *             replacing an existing key, the caller's <code>kms:Decrypt</code> dry-run is run on
+ *             the current key first, and only then on the new key.</p>
+ *          <p>If any of these checks fails, the operation fails and the existing key association
+ *             (if any) remains unchanged. Common failure causes include the key being disabled, the
+ *             key policy not granting the required permissions to Amazon CloudWatch, or the
+ *             caller lacking <code>kms:Decrypt</code> permission on the key.</p>
+ *          <p>For more information about using customer managed keys with Amazon CloudWatch,
+ *             see <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cmk-encryption.html">Encryption at rest
+ *                 with customer managed keys</a> in the <i>Amazon CloudWatch User
+ *                 Guide</i>.</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { CloudWatchClient, AssociateDatasetKmsKeyCommand } from "@aws-sdk/client-cloudwatch"; // ES Modules import
+ * // const { CloudWatchClient, AssociateDatasetKmsKeyCommand } = require("@aws-sdk/client-cloudwatch"); // CommonJS import
+ * // import type { CloudWatchClientConfig } from "@aws-sdk/client-cloudwatch";
+ * const config = {}; // type is CloudWatchClientConfig
+ * const client = new CloudWatchClient(config);
+ * const input = { // AssociateDatasetKmsKeyInput
+ *   DatasetIdentifier: "STRING_VALUE", // required
+ *   KmsKeyArn: "STRING_VALUE", // required
+ * };
+ * const command = new AssociateDatasetKmsKeyCommand(input);
+ * const response = await client.send(command);
+ * // {};
+ *
+ * ```
+ *
+ * @param AssociateDatasetKmsKeyCommandInput - {@link AssociateDatasetKmsKeyCommandInput}
+ * @returns {@link AssociateDatasetKmsKeyCommandOutput}
+ * @see {@link AssociateDatasetKmsKeyCommandInput} for command's `input` shape.
+ * @see {@link AssociateDatasetKmsKeyCommandOutput} for command's `response` shape.
+ * @see {@link CloudWatchClientResolvedConfig | config} for CloudWatchClient's `config` shape.
+ *
+ * @throws {@link ConflictException} (client fault)
+ *  <p>This operation attempted to create a resource that already exists.</p>
+ *
+ * @throws {@link KmsAccessDeniedException} (client fault)
+ *  <p>The operation was denied because either the calling principal lacks the required
+ *             Amazon Web Services Key Management Service (Amazon Web Services KMS) permission on the
+ *             key, or the key policy does not grant Amazon CloudWatch the permissions it needs
+ *             to use the key. Verify that the caller has <code>kms:Decrypt</code> permission on the
+ *             key, and that the key policy grants the CloudWatch service principal the
+ *             <code>kms:DescribeKey</code>, <code>kms:GenerateDataKey</code>,
+ *             <code>kms:Encrypt</code>, <code>kms:Decrypt</code>, and <code>kms:ReEncrypt*</code>
+ *             permissions described in <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_AssociateDatasetKmsKey.html">AssociateDatasetKmsKey</a>.</p>
+ *
+ * @throws {@link KmsKeyDisabledException} (client fault)
+ *  <p>The specified Amazon Web Services Key Management Service (Amazon Web Services KMS) key
+ *             is disabled or pending deletion. Re-enable the key (or restore it, if it is pending
+ *             deletion) and retry the operation.</p>
+ *
+ * @throws {@link KmsKeyNotFoundException} (client fault)
+ *  <p>The specified Amazon Web Services Key Management Service (Amazon Web Services KMS) key
+ *             could not be found. Verify that the key Amazon Resource Name (ARN) is correct, that
+ *             the key exists, and that it is in the same Amazon Web Services Region as the
+ *             resource.</p>
+ *
+ * @throws {@link ResourceNotFoundException} (client fault)
+ *  <p>The named resource does not exist.</p>
+ *
+ * @throws {@link CloudWatchServiceException}
+ * <p>Base exception class for all service exceptions from CloudWatch service.</p>
+ *
+ *
+ * @public
+ */
+export declare class AssociateDatasetKmsKeyCommand extends AssociateDatasetKmsKeyCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: AssociateDatasetKmsKeyInput;
+            output: {};
+        };
+        sdk: {
+            input: AssociateDatasetKmsKeyCommandInput;
+            output: AssociateDatasetKmsKeyCommandOutput;
+        };
+    };
+}

package/node_modules/@aws-sdk/client-cloudwatch/dist-types/commands/DisassociateDatasetKmsKeyCommand.d.ts

@@ -0,0 +1,105 @@
+import { Command as $Command } from "@smithy/core/client";
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CloudWatchClient";
+import type { DisassociateDatasetKmsKeyInput, DisassociateDatasetKmsKeyOutput } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+export { $Command };
+/**
+ * @public
+ *
+ * The input for {@link DisassociateDatasetKmsKeyCommand}.
+ */
+export interface DisassociateDatasetKmsKeyCommandInput extends DisassociateDatasetKmsKeyInput {
+}
+/**
+ * @public
+ *
+ * The output of {@link DisassociateDatasetKmsKeyCommand}.
+ */
+export interface DisassociateDatasetKmsKeyCommandOutput extends DisassociateDatasetKmsKeyOutput, __MetadataBearer {
+}
+declare const DisassociateDatasetKmsKeyCommand_base: {
+    new (input: DisassociateDatasetKmsKeyCommandInput): import("@smithy/core/client").CommandImpl<DisassociateDatasetKmsKeyCommandInput, DisassociateDatasetKmsKeyCommandOutput, CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    new (input: DisassociateDatasetKmsKeyCommandInput): import("@smithy/core/client").CommandImpl<DisassociateDatasetKmsKeyCommandInput, DisassociateDatasetKmsKeyCommandOutput, CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    getEndpointParameterInstructions(): {
+        [x: string]: unknown;
+    };
+};
+/**
+ * <p>Removes the customer managed Amazon Web Services Key Management Service
+ *             (Amazon Web Services KMS) key association from the specified dataset. After this
+ *             operation completes, data that you publish to the dataset is encrypted at rest using
+ *             an Amazon Web Services owned key managed by Amazon CloudWatch.</p>
+ *          <p>Only the <code>default</code> dataset is supported. To call this operation, the
+ *             dataset must currently have a customer managed KMS key associated with it. If the
+ *             dataset has no associated KMS key, the operation fails with
+ *             <code>ResourceNotFoundException</code>.</p>
+ *          <p>Amazon CloudWatch performs a dry-run <code>kms:Decrypt</code> call on the key
+ *             as part of this operation. This verifies that the caller is authorized to use the
+ *             currently associated key. The caller must have <code>kms:Decrypt</code> permission on
+ *             the currently associated key, and the key must be enabled and accessible. If the key
+ *             has been disabled or scheduled for deletion, you must first re-enable or restore it
+ *             before you can disassociate it from the dataset.</p>
+ *          <important>
+ *             <p>Disassociating a KMS key from a dataset does not immediately remove the
+ *                 <code>kms:Decrypt</code> requirement on data plane operations. For up to three
+ *                 hours after disassociation, callers must continue to have
+ *                 <code>kms:Decrypt</code> permission on the previously associated key. Some data
+ *                 may still be encrypted with that key during this window. After this enforcement
+ *                 window elapses, the <code>kms:Decrypt</code> requirement is lifted.</p>
+ *          </important>
+ *          <p>For more information about using customer managed keys with Amazon CloudWatch,
+ *             see <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cmk-encryption.html">Encryption at rest
+ *                 with customer managed keys</a> in the <i>Amazon CloudWatch User
+ *                 Guide</i>.</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { CloudWatchClient, DisassociateDatasetKmsKeyCommand } from "@aws-sdk/client-cloudwatch"; // ES Modules import
+ * // const { CloudWatchClient, DisassociateDatasetKmsKeyCommand } = require("@aws-sdk/client-cloudwatch"); // CommonJS import
+ * // import type { CloudWatchClientConfig } from "@aws-sdk/client-cloudwatch";
+ * const config = {}; // type is CloudWatchClientConfig
+ * const client = new CloudWatchClient(config);
+ * const input = { // DisassociateDatasetKmsKeyInput
+ *   DatasetIdentifier: "STRING_VALUE", // required
+ * };
+ * const command = new DisassociateDatasetKmsKeyCommand(input);
+ * const response = await client.send(command);
+ * // {};
+ *
+ * ```
+ *
+ * @param DisassociateDatasetKmsKeyCommandInput - {@link DisassociateDatasetKmsKeyCommandInput}
+ * @returns {@link DisassociateDatasetKmsKeyCommandOutput}
+ * @see {@link DisassociateDatasetKmsKeyCommandInput} for command's `input` shape.
+ * @see {@link DisassociateDatasetKmsKeyCommandOutput} for command's `response` shape.
+ * @see {@link CloudWatchClientResolvedConfig | config} for CloudWatchClient's `config` shape.
+ *
+ * @throws {@link ConflictException} (client fault)
+ *  <p>This operation attempted to create a resource that already exists.</p>
+ *
+ * @throws {@link ResourceNotFoundException} (client fault)
+ *  <p>The named resource does not exist.</p>
+ *
+ * @throws {@link CloudWatchServiceException}
+ * <p>Base exception class for all service exceptions from CloudWatch service.</p>
+ *
+ *
+ * @public
+ */
+export declare class DisassociateDatasetKmsKeyCommand extends DisassociateDatasetKmsKeyCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: DisassociateDatasetKmsKeyInput;
+            output: {};
+        };
+        sdk: {
+            input: DisassociateDatasetKmsKeyCommandInput;
+            output: DisassociateDatasetKmsKeyCommandOutput;
+        };
+    };
+}

package/node_modules/@aws-sdk/client-cloudwatch/dist-types/commands/GetDatasetCommand.d.ts

@@ -0,0 +1,91 @@
+import { Command as $Command } from "@smithy/core/client";
+import type { MetadataBearer as __MetadataBearer } from "@smithy/types";
+import type { CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes } from "../CloudWatchClient";
+import type { GetDatasetInput, GetDatasetOutput } from "../models/models_0";
+/**
+ * @public
+ */
+export type { __MetadataBearer };
+export { $Command };
+/**
+ * @public
+ *
+ * The input for {@link GetDatasetCommand}.
+ */
+export interface GetDatasetCommandInput extends GetDatasetInput {
+}
+/**
+ * @public
+ *
+ * The output of {@link GetDatasetCommand}.
+ */
+export interface GetDatasetCommandOutput extends GetDatasetOutput, __MetadataBearer {
+}
+declare const GetDatasetCommand_base: {
+    new (input: GetDatasetCommandInput): import("@smithy/core/client").CommandImpl<GetDatasetCommandInput, GetDatasetCommandOutput, CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    new (input: GetDatasetCommandInput): import("@smithy/core/client").CommandImpl<GetDatasetCommandInput, GetDatasetCommandOutput, CloudWatchClientResolvedConfig, ServiceInputTypes, ServiceOutputTypes>;
+    getEndpointParameterInstructions(): {
+        [x: string]: unknown;
+    };
+};
+/**
+ * <p>Returns information about the specified dataset. This includes its identifier,
+ *             Amazon Resource Name (ARN), and any customer managed Amazon Web Services Key
+ *             Management Service (Amazon Web Services KMS) key that is currently associated with
+ *             it.</p>
+ *          <p>Only the <code>default</code> dataset is supported. The <code>default</code> dataset
+ *             is implicit for every account in every Region — you can call <code>GetDataset</code>
+ *             for it without first creating it. If no customer managed KMS key has been associated
+ *             with the dataset, the response omits the <code>KmsKeyArn</code> field, indicating that
+ *             data is encrypted at rest using an Amazon Web Services owned key managed by
+ *             Amazon CloudWatch.</p>
+ *          <p>To associate a customer managed KMS key with a dataset, use <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_AssociateDatasetKmsKey.html">AssociateDatasetKmsKey</a>. To remove the association, use <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_DisassociateDatasetKmsKey.html">DisassociateDatasetKmsKey</a>.</p>
+ * @example
+ * Use a bare-bones client and the command you need to make an API call.
+ * ```javascript
+ * import { CloudWatchClient, GetDatasetCommand } from "@aws-sdk/client-cloudwatch"; // ES Modules import
+ * // const { CloudWatchClient, GetDatasetCommand } = require("@aws-sdk/client-cloudwatch"); // CommonJS import
+ * // import type { CloudWatchClientConfig } from "@aws-sdk/client-cloudwatch";
+ * const config = {}; // type is CloudWatchClientConfig
+ * const client = new CloudWatchClient(config);
+ * const input = { // GetDatasetInput
+ *   DatasetIdentifier: "STRING_VALUE", // required
+ * };
+ * const command = new GetDatasetCommand(input);
+ * const response = await client.send(command);
+ * // { // GetDatasetOutput
+ * //   DatasetId: "STRING_VALUE", // required
+ * //   Arn: "STRING_VALUE", // required
+ * //   KmsKeyArn: "STRING_VALUE",
+ * // };
+ *
+ * ```
+ *
+ * @param GetDatasetCommandInput - {@link GetDatasetCommandInput}
+ * @returns {@link GetDatasetCommandOutput}
+ * @see {@link GetDatasetCommandInput} for command's `input` shape.
+ * @see {@link GetDatasetCommandOutput} for command's `response` shape.
+ * @see {@link CloudWatchClientResolvedConfig | config} for CloudWatchClient's `config` shape.
+ *
+ * @throws {@link ResourceNotFoundException} (client fault)
+ *  <p>The named resource does not exist.</p>
+ *
+ * @throws {@link CloudWatchServiceException}
+ * <p>Base exception class for all service exceptions from CloudWatch service.</p>
+ *
+ *
+ * @public
+ */
+export declare class GetDatasetCommand extends GetDatasetCommand_base {
+    /** @internal type navigation helper, not in runtime. */
+    protected static __types: {
+        api: {
+            input: GetDatasetInput;
+            output: GetDatasetOutput;
+        };
+        sdk: {
+            input: GetDatasetCommandInput;
+            output: GetDatasetCommandOutput;
+        };
+    };
+}

package/node_modules/@aws-sdk/client-cloudwatch/dist-types/commands/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./AssociateDatasetKmsKeyCommand";
 export * from "./DeleteAlarmMuteRuleCommand";
 export * from "./DeleteAlarmsCommand";
 export * from "./DeleteAnomalyDetectorCommand";
@@ -12,10 +13,12 @@ export * from "./DescribeAnomalyDetectorsCommand";
 export * from "./DescribeInsightRulesCommand";
 export * from "./DisableAlarmActionsCommand";
 export * from "./DisableInsightRulesCommand";
+export * from "./DisassociateDatasetKmsKeyCommand";
 export * from "./EnableAlarmActionsCommand";
 export * from "./EnableInsightRulesCommand";
 export * from "./GetAlarmMuteRuleCommand";
 export * from "./GetDashboardCommand";
+export * from "./GetDatasetCommand";
 export * from "./GetInsightRuleReportCommand";
 export * from "./GetMetricDataCommand";
 export * from "./GetMetricStatisticsCommand";

package/node_modules/@aws-sdk/client-cloudwatch/dist-types/models/errors.d.ts

@@ -2,30 +2,96 @@ import type { ExceptionOptionType as __ExceptionOptionType } from "@smithy/core/
 import { CloudWatchServiceException as __BaseException } from "./CloudWatchServiceException";
 import type { DashboardValidationMessage } from "./models_0";
 /**
- * <p>More than one process tried to modify a resource at the same time.</p>
+ * <p>This operation attempted to create a resource that already exists.</p>
  * @public
  */
-export declare class ConcurrentModificationException extends __BaseException {
-    readonly name: "ConcurrentModificationException";
+export declare class ConflictException extends __BaseException {
+    readonly name: "ConflictException";
     readonly $fault: "client";
     Message?: string | undefined;
     /**
      * @internal
      */
-    constructor(opts: __ExceptionOptionType<ConcurrentModificationException, __BaseException>);
+    constructor(opts: __ExceptionOptionType<ConflictException, __BaseException>);
 }
 /**
- * <p>This operation attempted to create a resource that already exists.</p>
+ * <p>The operation was denied because either the calling principal lacks the required
+ *             Amazon Web Services Key Management Service (Amazon Web Services KMS) permission on the
+ *             key, or the key policy does not grant Amazon CloudWatch the permissions it needs
+ *             to use the key. Verify that the caller has <code>kms:Decrypt</code> permission on the
+ *             key, and that the key policy grants the CloudWatch service principal the
+ *             <code>kms:DescribeKey</code>, <code>kms:GenerateDataKey</code>,
+ *             <code>kms:Encrypt</code>, <code>kms:Decrypt</code>, and <code>kms:ReEncrypt*</code>
+ *             permissions described in <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/API_AssociateDatasetKmsKey.html">AssociateDatasetKmsKey</a>.</p>
  * @public
  */
-export declare class ConflictException extends __BaseException {
-    readonly name: "ConflictException";
+export declare class KmsAccessDeniedException extends __BaseException {
+    readonly name: "KmsAccessDeniedException";
+    readonly $fault: "client";
+    Message: string | undefined;
+    /**
+     * @internal
+     */
+    constructor(opts: __ExceptionOptionType<KmsAccessDeniedException, __BaseException>);
+}
+/**
+ * <p>The specified Amazon Web Services Key Management Service (Amazon Web Services KMS) key
+ *             is disabled or pending deletion. Re-enable the key (or restore it, if it is pending
+ *             deletion) and retry the operation.</p>
+ * @public
+ */
+export declare class KmsKeyDisabledException extends __BaseException {
+    readonly name: "KmsKeyDisabledException";
+    readonly $fault: "client";
+    Message: string | undefined;
+    /**
+     * @internal
+     */
+    constructor(opts: __ExceptionOptionType<KmsKeyDisabledException, __BaseException>);
+}
+/**
+ * <p>The specified Amazon Web Services Key Management Service (Amazon Web Services KMS) key
+ *             could not be found. Verify that the key Amazon Resource Name (ARN) is correct, that
+ *             the key exists, and that it is in the same Amazon Web Services Region as the
+ *             resource.</p>
+ * @public
+ */
+export declare class KmsKeyNotFoundException extends __BaseException {
+    readonly name: "KmsKeyNotFoundException";
+    readonly $fault: "client";
+    Message: string | undefined;
+    /**
+     * @internal
+     */
+    constructor(opts: __ExceptionOptionType<KmsKeyNotFoundException, __BaseException>);
+}
+/**
+ * <p>The named resource does not exist.</p>
+ * @public
+ */
+export declare class ResourceNotFoundException extends __BaseException {
+    readonly name: "ResourceNotFoundException";
     readonly $fault: "client";
+    ResourceType?: string | undefined;
+    ResourceId?: string | undefined;
     Message?: string | undefined;
     /**
      * @internal
      */
-    constructor(opts: __ExceptionOptionType<ConflictException, __BaseException>);
+    constructor(opts: __ExceptionOptionType<ResourceNotFoundException, __BaseException>);
+}
+/**
+ * <p>More than one process tried to modify a resource at the same time.</p>
+ * @public
+ */
+export declare class ConcurrentModificationException extends __BaseException {
+    readonly name: "ConcurrentModificationException";
+    readonly $fault: "client";
+    Message?: string | undefined;
+    /**
+     * @internal
+     */
+    constructor(opts: __ExceptionOptionType<ConcurrentModificationException, __BaseException>);
 }
 /**
  * <p>Some part of the dashboard data is invalid.</p>
@@ -118,21 +184,6 @@ export declare class MissingRequiredParameterException extends __BaseException {
      */
     constructor(opts: __ExceptionOptionType<MissingRequiredParameterException, __BaseException>);
 }
-/**
- * <p>The named resource does not exist.</p>
- * @public
- */
-export declare class ResourceNotFoundException extends __BaseException {
-    readonly name: "ResourceNotFoundException";
-    readonly $fault: "client";
-    ResourceType?: string | undefined;
-    ResourceId?: string | undefined;
-    Message?: string | undefined;
-    /**
-     * @internal
-     */
-    constructor(opts: __ExceptionOptionType<ResourceNotFoundException, __BaseException>);
-}
 /**
  * <p>The next token specified is invalid.</p>
  * @public

package/node_modules/@aws-sdk/client-cloudwatch/dist-types/models/models_0.d.ts

@@ -521,6 +521,39 @@ export interface AnomalyDetector {
      */
     MetricMathAnomalyDetector?: MetricMathAnomalyDetector | undefined;
 }
+/**
+ * @public
+ */
+export interface AssociateDatasetKmsKeyInput {
+    /**
+     * <p>Specifies the identifier of the dataset that you want to associate the KMS key
+     *             with. For the <code>default</code> dataset, you can specify either
+     *             <code>default</code> or the full dataset Amazon Resource Name (ARN) in the format
+     *             <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/default</code>.</p>
+     * @public
+     */
+    DatasetIdentifier: string | undefined;
+    /**
+     * <p>Specifies the Amazon Resource Name (ARN) of the customer managed KMS key to
+     *             associate with the dataset. The key must be a symmetric encryption KMS key
+     *             (<code>SYMMETRIC_DEFAULT</code>) in the same Amazon Web Services Region as the
+     *             dataset.</p>
+     *          <p>The ARN must be in the format
+     *             <code>arn:aws:kms:<i>Region</i>:<i>account-id</i>:key/<i>key-id</i>
+     *             </code>.
+     *             Key IDs, aliases, and alias ARNs are not accepted.</p>
+     *          <p>For more information about KMS key ARNs, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN">Key ARN</a> in
+     *             the <i>Amazon Web Services Key Management Service Developer
+     *                 Guide</i>.</p>
+     * @public
+     */
+    KmsKeyArn: string | undefined;
+}
+/**
+ * @public
+ */
+export interface AssociateDatasetKmsKeyOutput {
+}
 /**
  * <p>This array is empty if the API operation was successful for all the rules specified in
  *             the request. If the operation could not process one of the rules, the following data is
@@ -1632,6 +1665,24 @@ export interface DisableInsightRulesOutput {
      */
     Failures?: PartialFailure[] | undefined;
 }
+/**
+ * @public
+ */
+export interface DisassociateDatasetKmsKeyInput {
+    /**
+     * <p>Specifies the identifier of the dataset from which to remove the KMS key
+     *             association. For the <code>default</code> dataset, you can specify either
+     *             <code>default</code> or the full dataset Amazon Resource Name (ARN) in the format
+     *             <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/default</code>.</p>
+     * @public
+     */
+    DatasetIdentifier: string | undefined;
+}
+/**
+ * @public
+ */
+export interface DisassociateDatasetKmsKeyOutput {
+}
 /**
  * @public
  */
@@ -2064,6 +2115,45 @@ export interface GetDashboardOutput {
      */
     DashboardName?: string | undefined;
 }
+/**
+ * @public
+ */
+export interface GetDatasetInput {
+    /**
+     * <p>Specifies the identifier of the dataset to retrieve. For the <code>default</code>
+     *             dataset, you can specify either <code>default</code> or the full dataset Amazon
+     *             Resource Name (ARN) in the format
+     *             <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/default</code>.</p>
+     * @public
+     */
+    DatasetIdentifier: string | undefined;
+}
+/**
+ * @public
+ */
+export interface GetDatasetOutput {
+    /**
+     * <p>Returns the identifier of the dataset.</p>
+     * @public
+     */
+    DatasetId: string | undefined;
+    /**
+     * <p>Returns the Amazon Resource Name (ARN) of the dataset, in the format
+     *             <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/<i>dataset-id</i>
+     *             </code>.</p>
+     * @public
+     */
+    Arn: string | undefined;
+    /**
+     * <p>Returns the Amazon Resource Name (ARN) of the customer managed Amazon Web Services
+     *             KMS key that is currently associated with the dataset, if any. If the dataset is not
+     *             associated with a customer managed KMS key, this field is not included in the
+     *             response and the dataset is encrypted at rest using an Amazon Web Services owned
+     *             key.</p>
+     * @public
+     */
+    KmsKeyArn?: string | undefined;
+}
 /**
  * @public
  */