EncryptionConfiguration - Amazon CloudWatch Omni
ContentsSee Also
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

EncryptionConfiguration

How a resource's data at rest is encrypted.

kmsKeyArn is required when encryptionStrategy is CUSTOMER_MANAGED and must be absent when it is AWS_OWNED; a mismatch is a ValidationException rather than a silently ignored field, so a caller that selects AWS_OWNED while still passing a key learns that the key was not applied.

Contents

encryptionStrategy

Which kind of key to use. Required.

Type: String

Valid Values: AWS_OWNED | CUSTOMER_MANAGED

Required: Yes

kmsKeyArn

Customer managed KMS key ARN. Required when encryptionStrategy is CUSTOMER_MANAGED, and must be omitted when it is AWS_OWNED. Must be a symmetric ENCRYPT_DECRYPT key in the caller's account and region.

Type: String

Pattern: arn:aws[a-zA-Z-]*:kms:[a-z0-9-]+:[0-9]{12}:key/(mrk-)?[a-f0-9-]+

Required: No

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: