KMS customer-managed key is enabled or pending deletion

Check ID: kms_cmk_are_used
Provider: AWS
Service: kms
Severity: LOW
Categories: encryption
Resource type: AwsKmsKey

What this check verifies

Customer-managed KMS keys are assessed by key state. Keys in Enabled are considered in use. Keys not Enabled and not PendingDeletion are identified as unused, while those in PendingDeletion are recognized as scheduled for removal.

Risk

Keeping unused CMKs increases attack surface and cost. If such keys are re-enabled or misconfigured, they can grant unintended decryption, impacting confidentiality. Deleting a key mistakenly thought unused can cause irrecoverable data loss, harming availability.

Recommendation

Adopt a key lifecycle: confirm actual usage with logs, owners, and tags; keep keys Enabled only when required; otherwise schedule deletion with a waiting period. Enforce least privilege to enable/disable or delete keys, require approvals, and monitor KMS activity with separation of duties.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kms enable-key —key-id <key_id>

# Terraform: ensure the KMS CMK is enabled
resource "aws_kms_key" "<example_resource_name>" {
  is_enabled = true  # Critical: sets key state to Enabled (PASS)
}

# CloudFormation: ensure the KMS CMK is enabled
Resources:
  <example_resource_name>:
    Type: AWS::KMS::Key
    Properties:
      Enabled: true  # Critical: enables the key so its state is "Enabled" (PASS)
      KeyPolicy:
        Version: '2012-10-17'
        Statement:
          - Sid: Enable IAM User Permissions
            Effect: Allow
            Principal:
              AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: 'kms:*'
            Resource: '*'

References

https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-determining-usage.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kms_cmk_are_used. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kinesis stream is encrypted at rest with KMS AWS KMS customer managed key is not scheduled for deletion

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires