AWS KMS Keys Should Not Be Unintentionally Deleted Rule

Rule Description

Troubleshooting Steps

2. 1.

   Check Logs: Review CloudTrail logs and Amazon CloudWatch Logs to identify any actions related to KMS key deletion. Look for API calls such as

   ScheduleKeyDeletion

   or

   CancelKeyDeletion

   . This will help determine if the deletion was intentional or accidental.

4. 2.

   Restore Deleted Key: If the deletion was accidental and the key was scheduled for deletion (but not yet permanently deleted), it can be restored within the specified waiting period (typically 30 days). Use the AWS Management Console or AWS CLI to restore the key.

6. 3.

   Create New Key: If the key is permanently deleted or cannot be restored, consider creating a new KMS key. Ensure that the new key is properly configured and associated with the necessary AWS resources.

Remediation Steps

2. 1.

   Enable Key Deletion Protection: Enable key deletion protection for your KMS keys. This ensures that keys cannot be deleted without explicitly disabling the protection. By default, this protection is disabled.

   • AWS Management Console: Go to the KMS service console, select the desired key, and enable deletion protection in the key settings.

   • AWS CLI: Use the

     update-key-description

     command to enable deletion protection for a specific key. Example:

     aws kms update-key-description --key-id <key-id> --deletion-protection-enabled true
     
4. 2.

   Assign Proper Permissions: Ensure that only authorized users or roles have the necessary permissions to delete KMS keys. Restrict access to key management through Identity and Access Management (IAM) policies.

   • AWS Management Console: Review and modify IAM policies associated with users and roles to ensure they do not have the

     kms:ScheduleKeyDeletion

     permission for critical keys.

   • AWS CLI: Use the

     aws iam attach-user-policy

     or

     aws iam attach-role-policy

     command to add or modify IAM policies associated with users or roles. Example:

     aws iam attach-user-policy --user-name <username> --policy-arn <policy-arn>
     
6. 3.

   Monitor Key Deletion Events: Implement proactive monitoring of KMS key deletion events. This helps detect and respond to any unauthorized or accidental deletion attempts.

   • AWS CloudTrail: Enable CloudTrail logging for KMS API calls and regularly review the logs to identify any suspicious activity related to key deletion.

   • Amazon CloudWatch Events: Set up CloudWatch Event rules to trigger notifications or automated actions in response to KMS key deletion events.