kms:DisconnectCustomKeyStore is a Write access-level action in the kms service. Controls permission to disconnect the custom key store from its associated AWS CloudHSM cluster or external key manager outside of AWS
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows kms:DisconnectCustomKeyStore. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowKmsDisconnectCustomKeyStore",
"Effect": "Allow",
"Action": "kms:DisconnectCustomKeyStore",
"Resource": "*"
}
]
}