Aqua CSPM

KMS Scheduled Deletion

Quick Info

Plugin TitleKMS Scheduled Deletion
CloudAWS
CategoryKMS
DescriptionDetects KMS keys that are scheduled for deletion
More InfoDeleting a KMS key will permanently prevent all data encrypted using that key from being decrypted. Avoid deleting keys unless no encrypted data is in use.
AWS Linkhttp://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
Recommended ActionDisable the key deletion before the scheduled deletion time.

Detailed Remediation Steps

  1. Log into the AWS Management Console.
  2. Select the “Services” option and search for KMS.
  3. Scroll down the left navigation panel and choose “Customer Managed Keys” under “Key Management Service”.
  4. Verify the “KMS keys” that are scheduled for deletion and “Status” is shown as “Pending deletion” under the “Customer managed keys”.
  5. Repeat step number 2 - 4 to verify other “KMS keys” which are scheduled for deletion in other regions in AWS.
  6. Navigate to “Customer Managed Keys” under “Key Management Service” and select the “KMS key” that needs to modify to disable the scheduled key deletion.
  7. Click on the “Key actions” button at the top and select the “Cancel key deletion” option to disable the scheduled deletion.
  8. Click on the “Disable” option under “Key actions” to disable the selected “KMS key” instead of deleting the key.
  9. Repeat steps number 6 - 8 to disable the key deletion before the scheduled deletion time.