All checks
Critical
AWS KMS keys should not be deleted unintentionally
Checks whether a customer managed KMS key is scheduled for deletion. When the waiting period ends the key is deleted and data encrypted under it can no longer be decrypted. A deliberate deletion needs no action: the finding clears once the key is gone.
- service
- KMS
- severity
- Critical
- scope
- evaluated in every region
How to fix it
In the console
Key Management Service → Customer managed keys → the key → Key actions
- Cancel key deletion
- Only if the deletion was not intended; possible only until the waiting period ends
- Enable
- Next, as a cancelled key is left Disabled and unusable (CLI: aws kms enable-key --key-id <key-id>)
With the AWS CLI
aws kms cancel-key-deletion --key-id <key-id> --region <region>See which of your accounts this check is failing on.
Book a live scan