For services that do not cache keys, the next API call using this XKS KMS key will fail. Some services implement data key caching or other key derivation schemes for performance, latency, or KMS cost management. Caching of these keys can vary from 5 mins to 24 hrs. Any protected resource that is currently in use (such as RDS database or EC2 instance) will respond differently after you deny access to the key. See the relevant AWS service documentation for details.