Enables or disables deletion protection for a customer master key (CMK).
Operation description
-
For details about the access policy that must be granted to a Resource Access Management (RAM) user or RAM role to invoke this operation, see Access control.
-
After you enable deletion protection for a CMK, you cannot delete the CMK. To delete the CMK, disable deletion protection first.
-
Before you invoke the SetDeletionProtection operation, make sure that the CMK is not in the PendingDeletion state. You can invoke the DescribeKey operation to query the status (KeyState) of the CMK.
Try it now
Test
RAM authorization
Request parameters
|
Parameter |
Type |
Required |
Description |
Example |
| ProtectedResourceArn |
string |
No |
The ARN of the CMK for which you want to set deletion protection. |
acs:kms:cn-hangzhou:123213123****:key/0225f411-b21d-46d1-be5b-93931c82**** |
| EnableDeletionProtection |
boolean |
Yes |
Specifies whether to enable deletion protection. Valid values:
|
true |
| DeletionProtectionDescription |
string |
No |
The description of deletion protection. Note
This parameter is valid only when EnableDeletionProtection is set to true. |
The CMK is being used by XXX. Deletion protection is set. |
| KeyId |
string |
No |
The ID of the key. |
key-hzz65f3a68554s6ms**** |
| KmsInstanceId |
string |
No |
For more information about common request parameters, see Common parameters.
Response elements
|
Element |
Type |
Description |
Example |
|
object |
|||
| RequestId |
string |
The request ID. Alibaba Cloud generates a unique identifier for each API request. You can use this ID to troubleshoot issues. |
3455b9b4-95c1-419d-b310-db6a53b09a39 |
Examples
Success response
JSON format
{
"RequestId": "3455b9b4-95c1-419d-b310-db6a53b09a39"
}Error codes
See Error Codes for a complete list.
Release notes
See Release Notes for a complete list.