Check provider logo

AWS KMS customer managed key is not scheduled for deletion

kms_cmk_not_deleted_unintentionally

Severitycritical
Servicekms
by Prowler
encryption

Customer-managed KMS keys are evaluated for the PendingDeletion state, indicating a scheduled deletion during the mandatory waiting period.

Risk

A key scheduled for deletion can lead to permanent loss of decryption capability, degrading availability and integrity of data and workloads. Accidental or malicious scheduling enables cryptographic erasure, causing outages, failed restores, and broken integrations during and after the wait window.

Run this check with Prowler CLI

prowler aws --checks kms_cmk_not_deleted_unintentionally

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks kms_cmk_not_deleted_unintentionally --fixer

Recommendation

Prevent unintended deletion:

  • Enforce least privilege and separation of duties for key admins
  • Require change approvals and alerts on deletion events
  • Prefer disabling unused keys over deleting
  • Set sufficient waiting periods and review keys in PendingDeletion to verify authorization

Remediation

CLI

aws kms cancel-key-deletion --key-id <KEY_ID>

Other
  1. Sign in to the AWS Management Console and open AWS KMS
  2. Go to Customer managed keys and select the key with status "Pending deletion"
  3. Click Key actions > Cancel key deletion
  4. Confirm to cancel; the key status will change from Pending deletion

Source Code

Resource Type

AwsKmsKey

References