Back to Checks
aws

KMS customer managed key is enabled or scheduled for deletion

kms_cmk_are_used
Service: kmsSeverity: low
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsKmsKey

Customer-managed KMS keys are assessed by key state. Keys in Enabled are considered in use. Keys not Enabled and not PendingDeletion are identified as unused, while those in PendingDeletion are recognized as scheduled for removal.

Prowler logoProwlerprowler-provider-aws

Risk

Keeping unused CMKs increases attack surface and cost.

If such keys are re-enabled or misconfigured, they can grant unintended decryption, impacting confidentiality. Deleting a key mistakenly thought unused can cause irrecoverable data loss, harming availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kms_cmk_are_used

Recommendation

Adopt a key lifecycle: confirm actual usage with logs, owners, and tags; keep keys Enabled only when required; otherwise schedule deletion with a waiting period.

Enforce least privilege to enable/disable or delete keys, require approvals, and monitor KMS activity with separation of duties.

Remediation

CLI

aws kms enable-key --key-id <key_id>

Terraform

# Terraform: ensure the KMS CMK is enabled
resource "aws_kms_key" "<example_resource_name>" {
  is_enabled = true  # Critical: sets key state to Enabled (PASS)
}

NativeIaC

# CloudFormation: ensure the KMS CMK is enabled
Resources:
  <example_resource_name>:
    Type: AWS::KMS::Key
    Properties:
      Enabled: true  # Critical: enables the key so its state is "Enabled" (PASS)
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: 'kms:*'
            Resource: '*'

Other

1Sign in to the AWS Console and open Key Management Service (KMS)
2Go to Customer managed keys and select the affected key
3Choose Key actions > Enable
4Confirm to enable the key

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kms.kms_client import kms_client


class kms_cmk_are_used(Check):
    def execute(self):
        findings = []
        for key in kms_client.keys:
            # Only check CMKs keys
            if key.manager == "CUSTOMER":
                report = Check_Report_AWS(metadata=self.metadata(), resource=key)
                if key.state != "Enabled":
                    if key.state == "PendingDeletion":
                        report.status = "PASS"
                        report.status_extended = f"KMS CMK {key.id} is not being used but it has scheduled deletion."
                    else:
                        report.status = "FAIL"
                        report.status_extended = f"KMS CMK {key.id} is not being used."
                else:
                    report.status = "PASS"
                    report.status_extended = f"KMS CMK {key.id} is being used."
                findings.append(report)
        return findings

References