Back to Checks
huaweicloud

KMS keys are not in pending deletion state

kms_key_not_pending_deletion
Service: kmsSeverity: medium
OfficialBuilt-inVerified
Categories:encryption
Resource Type:NotDefined

Huawei Cloud Key Management Service (KMS) keys that are in PendingDeletion state should be reviewed. Keys scheduled for deletion may cause decryption failures for dependent resources, leading to data unavailability. Ensure deletion is intentional and all dependent resources have been migrated.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

KMS keys in PendingDeletion will become permanently unavailable after the waiting period expires. Any data encrypted with these keys will become permanently inaccessible, potentially causing data loss and service outages.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks kms_key_not_pending_deletion

Recommendation

Review KMS keys in pending deletion state and cancel deletion if the key is still needed.

Remediation

CLI

hcloud KMS CancelKeyDeletion --key_id=<key_id>

Other

1Log on to the **Huawei Cloud console**.
2Choose **KMS**.
3Click **Keys**.
4Find the key in `PendingDeletion` state.
5If deletion was not intended, click **Cancel Deletion**.
6Confirm the action.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.kms.kms_client import kms_client


class kms_key_not_pending_deletion(Check):
    """Check if KMS keys are not in pending deletion state."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for key in kms_client.keys:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=key)
            report.region = key.region
            report.resource_id = key.id
            report.resource_arn = f"huaweicloud:kms:{key.region}:{kms_client.audited_account}:key/{key.id}"

            if key.state == "4":
                report.status = "FAIL"
                report.status_extended = (
                    f"KMS key {key.alias} ({key.id}) is in pending deletion state."
                )
            else:
                report.status = "PASS"
                report.status_extended = f"KMS key {key.alias} ({key.id}) is not in pending deletion state (state: {key.state})."

            findings.append(report)

        return findings

References