Check ID: cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
Provider: AWS
Service: cloudwatch
Severity: MEDIUM
Categories: logging
Resource type: AwsCloudWatchAlarm

​
What this check verifies

CloudTrail events delivered to CloudWatch are evaluated for a metric filter and alarm that monitor KMS CMK state changes, specifically DisableKey and ScheduleKeyDeletion from kms.amazonaws.com.

​
Risk

Missing alerts on CMK disablement or scheduled deletion undermines availability and integrity: encrypted data may become undecryptable, backups unusable, and recovery impossible. Attackers or insiders can change key states unnoticed, causing outages and irreversible data loss.

​
Recommendation

Establish CloudWatch metric filters and alarms for DisableKey and ScheduleKeyDeletion CloudTrail events to enable rapid response.
  • Apply least privilege to KMS administration
  • Enforce change control and separation of duties
  • Use deletion waiting periods and monitor all regions

​
Remediation

# Metric filter for KMS DisableKey or ScheduleKeyDeletion
resource "aws_cloudwatch_log_metric_filter" "cmk" {
  name           = "<example_resource_name>"
  log_group_name = "<example_resource_name>" # CRITICAL: CloudTrail log group
  # CRITICAL: Detect KMS key disable or scheduled deletion events
  pattern = "{($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }"

  metric_transformation {
    name      = "disable_or_delete_cmk_changes_metric" # CRITICAL: metric used by alarm
    namespace = "CISBenchmark"
    value     = "1"
  }
}

# Alarm for the metric above
resource "aws_cloudwatch_metric_alarm" "cmk" {
  alarm_name          = "<example_resource_name>"
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  metric_name         = "disable_or_delete_cmk_changes_metric" # CRITICAL: same metric name
  namespace           = "CISBenchmark"
  period              = 300
  statistic           = "Sum"
  threshold           = 1
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks