Back to Checks
aws

AWS KMS customer managed key is not scheduled for deletion

kms_cmk_not_deleted_unintentionally
Service: kmsSeverity: critical
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsKmsKey

Customer-managed KMS keys are evaluated for the PendingDeletion state, indicating a scheduled deletion during the mandatory waiting period.

Prowler logoProwlerprowler-provider-aws

Risk

A key scheduled for deletion can lead to permanent loss of decryption capability, degrading availability and integrity of data and workloads. Accidental or malicious scheduling enables cryptographic erasure, causing outages, failed restores, and broken integrations during and after the wait window.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kms_cmk_not_deleted_unintentionally

Recommendation

Prevent unintended deletion:

  • Enforce least privilege and separation of duties for key admins
  • Require change approvals and alerts on deletion events
  • Prefer disabling unused keys over deleting
  • Set sufficient waiting periods and review keys in PendingDeletion to verify authorization

Remediation

CLI

aws kms cancel-key-deletion --key-id <KEY_ID>

Other

1Sign in to the AWS Management Console and open AWS KMS
2Go to Customer managed keys and select the key with status "Pending deletion"
3Click Key actions > Cancel key deletion
4Confirm to cancel; the key status will change from Pending deletion

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kms.kms_client import kms_client


class kms_cmk_not_deleted_unintentionally(Check):
    def execute(self):
        findings = []
        for key in kms_client.keys:
            if key.manager == "CUSTOMER":
                if key.state != "Disabled" or kms_client.provider.scan_unused_services:
                    report = Check_Report_AWS(metadata=self.metadata(), resource=key)
                    report.status = "PASS"
                    report.status_extended = (
                        f"KMS CMK {key.id} is not scheduled for deletion."
                    )
                    if key.state == "PendingDeletion":
                        report.status = "FAIL"
                        report.status_extended = f"KMS CMK {key.id} is scheduled for deletion, revert it if it was unintentionally."
                    findings.append(report)
        return findings

References