kms:DisconnectCustomKeyStore is a Write access-level action in the kms service. Controls permission to disconnect the custom key store from its associated AWS CloudHSM cluster or external key manager outside of AWS
This action does not support resource-level permissions; use "Resource": "*" in your policy.
Keys you can use in the Condition block of a policy that grants kms:DisconnectCustomKeyStore.
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement
A minimal policy that allows kms:DisconnectCustomKeyStore. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsDisconnectCustomKeyStore",
"Effect": "Allow",
"Action": "kms:DisconnectCustomKeyStore",
"Resource": "*"
}
]
}