Check ID: kms_cmk_not_deleted_unintentionally
Provider: AWS
Service: kms
Severity: CRITICAL
Categories: encryption
Resource type: AwsKmsKey

​
What this check verifies

Customer-managed KMS keys are evaluated for the PendingDeletion state, indicating a scheduled deletion during the mandatory waiting period.

​
Risk

A key scheduled for deletion can lead to permanent loss of decryption capability, degrading availability and integrity of data and workloads. Accidental or malicious scheduling enables cryptographic erasure, causing outages, failed restores, and broken integrations during and after the wait window.

​
Recommendation

Prevent unintended deletion:
  • Enforce least privilege and separation of duties for key admins
  • Require change approvals and alerts on deletion events
  • Prefer disabling unused keys over deleting
  • Set sufficient waiting periods and review keys in PendingDeletion to verify authorization

​
Remediation

aws kms cancel-key-deletion —key-id <KEY_ID>

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kms_cmk_not_deleted_unintentionally. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks