// Code generated by software.amazon.smithy.rust.codegen.smithy-rs. DO NOT EDIT.
pub use crate::operation::associate_dataset_kms_key::_associate_dataset_kms_key_input::AssociateDatasetKmsKeyInputBuilder;
pub use crate::operation::associate_dataset_kms_key::_associate_dataset_kms_key_output::AssociateDatasetKmsKeyOutputBuilder;
impl crate::operation::associate_dataset_kms_key::builders::AssociateDatasetKmsKeyInputBuilder {
/// Sends a request with this input using the given client.
pub async fn send_with(
self,
client: &crate::Client,
) -> ::std::result::Result<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyOutput,
::aws_smithy_runtime_api::client::result::SdkError<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyError,
::aws_smithy_runtime_api::client::orchestrator::HttpResponse,
>,
> {
let mut fluent_builder = client.associate_dataset_kms_key();
fluent_builder.inner = self;
fluent_builder.send().await
}
}
/// Fluent builder constructing a request to `AssociateDatasetKmsKey`.
///
/// <p>Associates an Amazon Web Services Key Management Service (Amazon Web Services KMS) customer managed key with the specified dataset. After this operation completes, all data published to the dataset is encrypted at rest using the specified KMS key. Callers must have <code>kms:Decrypt</code> permission on the key to read the encrypted data.</p>
/// <p>Only the <code>default</code> dataset is supported. The <code>default</code> dataset is implicit for every account in every Region — you do not need to create it before calling this operation.</p>
/// <p>You can call <code>AssociateDatasetKmsKey</code> on a dataset that is already associated with a KMS key to replace the existing key with a different one. To replace a key, the caller must have <code>kms:Decrypt</code> permission on both the current key and the new key.</p>
/// <p>The KMS key that you specify must meet all of the following requirements:</p>
/// <ul>
/// <li>
/// <p>It must be a symmetric encryption KMS key (key spec <code>SYMMETRIC_DEFAULT</code>, key usage <code>ENCRYPT_DECRYPT</code>). Asymmetric keys, HMAC keys, and key material types other than <code>SYMMETRIC_DEFAULT</code> are not supported.</p></li>
/// <li>
/// <p>It must be enabled and not pending deletion.</p></li>
/// <li>
/// <p>Its key policy must grant the CloudWatch service principal (<code>cloudwatch.amazonaws.com</code>) these permissions: <code>kms:DescribeKey</code>, <code>kms:GenerateDataKey</code>, <code>kms:Encrypt</code>, <code>kms:Decrypt</code>, and <code>kms:ReEncrypt*</code>. Amazon CloudWatch requires these permissions to manage the data on your behalf.</p></li>
/// <li>
/// <p>The calling principal must have <code>kms:Decrypt</code> permission on the key.</p></li>
/// <li>
/// <p>It must be specified as a fully qualified key ARN. Key IDs, aliases, and alias ARNs are not accepted.</p></li>
/// <li>
/// <p>It must be in the same Amazon Web Services Region as the dataset.</p></li>
/// </ul>
/// <p>Before completing the association, Amazon CloudWatch validates the key by performing a series of dry-run KMS operations. Service-principal checks run first to verify that the key policy grants the required access to Amazon CloudWatch. These checks include <code>kms:DescribeKey</code>, <code>kms:GenerateDataKey</code>, <code>kms:Encrypt</code>, <code>kms:Decrypt</code>, and <code>kms:ReEncrypt*</code>. After those succeed, a <code>kms:Decrypt</code> dry-run is run with the caller's credentials to verify that the calling principal can use the key. When you are replacing an existing key, the caller's <code>kms:Decrypt</code> dry-run is run on the current key first, and only then on the new key.</p>
/// <p>If any of these checks fails, the operation fails and the existing key association (if any) remains unchanged. Common failure causes include the key being disabled, the key policy not granting the required permissions to Amazon CloudWatch, or the caller lacking <code>kms:Decrypt</code> permission on the key.</p>
/// <p>For more information about using customer managed keys with Amazon CloudWatch, see <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cmk-encryption.html">Encryption at rest with customer managed keys</a> in the <i>Amazon CloudWatch User Guide</i>.</p>
#[derive(::std::clone::Clone, ::std::fmt::Debug)]
pub struct AssociateDatasetKmsKeyFluentBuilder {
handle: ::std::sync::Arc<crate::client::Handle>,
inner: crate::operation::associate_dataset_kms_key::builders::AssociateDatasetKmsKeyInputBuilder,
config_override: ::std::option::Option<crate::config::Builder>,
}
impl
crate::client::customize::internal::CustomizableSend<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyOutput,
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyError,
> for AssociateDatasetKmsKeyFluentBuilder
{
fn send(
self,
config_override: crate::config::Builder,
) -> crate::client::customize::internal::BoxFuture<
crate::client::customize::internal::SendResult<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyOutput,
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyError,
>,
> {
::std::boxed::Box::pin(async move { self.config_override(config_override).send().await })
}
}
impl AssociateDatasetKmsKeyFluentBuilder {
/// Creates a new `AssociateDatasetKmsKeyFluentBuilder`.
pub(crate) fn new(handle: ::std::sync::Arc<crate::client::Handle>) -> Self {
Self {
handle,
inner: ::std::default::Default::default(),
config_override: ::std::option::Option::None,
}
}
/// Access the AssociateDatasetKmsKey as a reference.
pub fn as_input(&self) -> &crate::operation::associate_dataset_kms_key::builders::AssociateDatasetKmsKeyInputBuilder {
&self.inner
}
/// Sends the request and returns the response.
///
/// If an error occurs, an `SdkError` will be returned with additional details that
/// can be matched against.
///
/// By default, any retryable failures will be retried twice. Retry behavior
/// is configurable with the [RetryConfig](aws_smithy_types::retry::RetryConfig), which can be
/// set when configuring the client.
pub async fn send(
self,
) -> ::std::result::Result<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyOutput,
::aws_smithy_runtime_api::client::result::SdkError<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyError,
::aws_smithy_runtime_api::client::orchestrator::HttpResponse,
>,
> {
let input = self
.inner
.build()
.map_err(::aws_smithy_runtime_api::client::result::SdkError::construction_failure)?;
let runtime_plugins = crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKey::operation_runtime_plugins(
self.handle.runtime_plugins.clone(),
&self.handle.conf,
self.config_override,
);
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKey::orchestrate(&runtime_plugins, input).await
}
/// Consumes this builder, creating a customizable operation that can be modified before being sent.
pub fn customize(
self,
) -> crate::client::customize::CustomizableOperation<
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyOutput,
crate::operation::associate_dataset_kms_key::AssociateDatasetKmsKeyError,
Self,
> {
crate::client::customize::CustomizableOperation::new(self)
}
pub(crate) fn config_override(mut self, config_override: impl ::std::convert::Into<crate::config::Builder>) -> Self {
self.set_config_override(::std::option::Option::Some(config_override.into()));
self
}
pub(crate) fn set_config_override(&mut self, config_override: ::std::option::Option<crate::config::Builder>) -> &mut Self {
self.config_override = config_override;
self
}
/// <p>Specifies the identifier of the dataset that you want to associate the KMS key with. For the <code>default</code> dataset, you can specify either <code>default</code> or the full dataset Amazon Resource Name (ARN) in the format <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/default</code>.</p>
pub fn dataset_identifier(mut self, input: impl ::std::convert::Into<::std::string::String>) -> Self {
self.inner = self.inner.dataset_identifier(input.into());
self
}
/// <p>Specifies the identifier of the dataset that you want to associate the KMS key with. For the <code>default</code> dataset, you can specify either <code>default</code> or the full dataset Amazon Resource Name (ARN) in the format <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/default</code>.</p>
pub fn set_dataset_identifier(mut self, input: ::std::option::Option<::std::string::String>) -> Self {
self.inner = self.inner.set_dataset_identifier(input);
self
}
/// <p>Specifies the identifier of the dataset that you want to associate the KMS key with. For the <code>default</code> dataset, you can specify either <code>default</code> or the full dataset Amazon Resource Name (ARN) in the format <code>arn:aws:cloudwatch:<i>Region</i>:<i>account-id</i>:dataset/default</code>.</p>
pub fn get_dataset_identifier(&self) -> &::std::option::Option<::std::string::String> {
self.inner.get_dataset_identifier()
}
/// <p>Specifies the Amazon Resource Name (ARN) of the customer managed KMS key to associate with the dataset. The key must be a symmetric encryption KMS key (<code>SYMMETRIC_DEFAULT</code>) in the same Amazon Web Services Region as the dataset.</p>
/// <p>The ARN must be in the format <code>arn:aws:kms:<i>Region</i>:<i>account-id</i>:key/<i>key-id</i> </code>. Key IDs, aliases, and alias ARNs are not accepted.</p>
/// <p>For more information about KMS key ARNs, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN">Key ARN</a> in the <i>Amazon Web Services Key Management Service Developer Guide</i>.</p>
pub fn kms_key_arn(mut self, input: impl ::std::convert::Into<::std::string::String>) -> Self {
self.inner = self.inner.kms_key_arn(input.into());
self
}
/// <p>Specifies the Amazon Resource Name (ARN) of the customer managed KMS key to associate with the dataset. The key must be a symmetric encryption KMS key (<code>SYMMETRIC_DEFAULT</code>) in the same Amazon Web Services Region as the dataset.</p>
/// <p>The ARN must be in the format <code>arn:aws:kms:<i>Region</i>:<i>account-id</i>:key/<i>key-id</i> </code>. Key IDs, aliases, and alias ARNs are not accepted.</p>
/// <p>For more information about KMS key ARNs, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN">Key ARN</a> in the <i>Amazon Web Services Key Management Service Developer Guide</i>.</p>
pub fn set_kms_key_arn(mut self, input: ::std::option::Option<::std::string::String>) -> Self {
self.inner = self.inner.set_kms_key_arn(input);
self
}
/// <p>Specifies the Amazon Resource Name (ARN) of the customer managed KMS key to associate with the dataset. The key must be a symmetric encryption KMS key (<code>SYMMETRIC_DEFAULT</code>) in the same Amazon Web Services Region as the dataset.</p>
/// <p>The ARN must be in the format <code>arn:aws:kms:<i>Region</i>:<i>account-id</i>:key/<i>key-id</i> </code>. Key IDs, aliases, and alias ARNs are not accepted.</p>
/// <p>For more information about KMS key ARNs, see <a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN">Key ARN</a> in the <i>Amazon Web Services Key Management Service Developer Guide</i>.</p>
pub fn get_kms_key_arn(&self) -> &::std::option::Option<::std::string::String> {
self.inner.get_kms_key_arn()
}
}