Skip to content

Latest commit

 

History

History
26 lines (22 loc) · 2.05 KB

kms-scheduled-deletion.md

File metadata and controls

26 lines (22 loc) · 2.05 KB

CloudSploit

AWS / KMS / KMS Scheduled Deletion

Quick Info

Plugin Title KMS Scheduled Deletion
Cloud AWS
Category KMS
Description Detects KMS keys that are scheduled for deletion
More Info Deleting a KMS key will permanently prevent all data encrypted using that key from being decrypted. Avoid deleting keys unless no encrypted data is in use.
AWS Link http://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html
Recommended Action Disable the key deletion before the scheduled deletion time.

Detailed Remediation Steps

  1. Log in to the AWS Management Console.
  2. Select the "Services" option and search for KMS.
  3. Scroll down the left navigation panel and choose "Customer Managed Keys" under "Key Management Service".
  4. Verify the "KMS keys" that are scheduled for deletion and "Status" is shown as "Pending deletion" under the "Customer managed keys".
  5. Repeat step number 2 - 4 to verify other "KMS keys" which are scheduled for deletion in other regions in AWS.
  6. Navigate to "Customer Managed Keys" under "Key Management Service" and select the "KMS key" that needs to be modified to disable the scheduled key deletion.
  7. Click on the "Key actions" button at the top and select the "Cancel key deletion" option to disable the scheduled deletion.
  8. Click on the "Disable" option under "Key actions" to disable the selected "KMS key" instead of deleting the key.
  9. Repeat step number 6 - 8 to disable the key deletion before the scheduled deletion time.