deactivate_key_signing_key
async
¶
deactivate_key_signing_key(
hosted_zone_id: ResourceId,
name: SigningKeyName,
*,
config_overrides: Optional[AsyncRoute53ClientConfig] = None,
) -> DeactivateKeySigningKeyResponse
Deactivates a key-signing key (KSK) so that it will not be used for signing by DNSSEC. This operation changes the KSK status to INACTIVE.
Parameters:
-
hosted_zone_id(ResourceId) –A unique string used to identify a hosted zone.
-
name(SigningKeyName) –A string used to identify a key-signing key (KSK).
Raises:
-
ConcurrentModification–Another user submitted a request to create, update, or delete the object at the same time that you did. Retry the request.
-
InvalidInput–The input is not valid.
-
InvalidKeySigningKeyStatus–The key-signing key (KSK) status isn't valid or another KSK has the status
INTERNAL_FAILURE. -
InvalidSigningStatus–Your hosted zone status isn't valid for this operation. In the hosted zone, change the status to enable
DNSSECor disableDNSSEC. -
KeySigningKeyInParentDSRecord–The key-signing key (KSK) is specified in a parent DS record.
-
KeySigningKeyInUse–The key-signing key (KSK) that you specified can't be deactivated because it's the only KSK for a currently-enabled DNSSEC. Disable DNSSEC signing, or add or enable another KSK.
-
NoSuchKeySigningKey–The specified key-signing key (KSK) doesn't exist.
-
UnknownServiceError–The service returned an error code this client does not model.