Customer-managed KMS keys are assessed by key state. Keys in Enabled are considered in use. Keys not Enabled and not PendingDeletion are identified as unused, while those in PendingDeletion are recognized as scheduled for removal.
Risk
Keeping unused CMKs increases attack surface and cost.
If such keys are re-enabled or misconfigured, they can grant unintended decryption, impacting confidentiality. Deleting a key mistakenly thought unused can cause irrecoverable data loss, harming availability.
prowler aws --checks kms_cmk_are_used
Recommendation
Adopt a key lifecycle: confirm actual usage with logs, owners, and tags; keep keys Enabled only when required; otherwise schedule deletion with a waiting period.
Enforce least privilege to enable/disable or delete keys, require approvals, and monitor KMS activity with separation of duties.
Remediation
aws kms enable-key --key-id <key_id>
- Sign in to the AWS Console and open Key Management Service (KMS)
- Go to Customer managed keys and select the affected key
- Choose Key actions > Enable
- Confirm to enable the key
Source Code
Resource Type
AwsKmsKey