KMSInvalidStateException security resource_error ai_generated true

AWS KMS key deletion failed due to pending deletion without waiting period

ID: security/aws-kms-key-deletion-without-wait-period

Also available as: JSON · Markdown · 中文

92%Fix Rate

88%Confidence

1Evidence

2023-11-10First Seen

Version Compatibility

Version	Status	Introduced	Deprecated	Notes
AWS KMS API 2014-11-01	active	—	—	—
AWS SDK for Python (boto3) 1.26.0	active	—	—	—
AWS CLI 2.x	active	—	—	—
Terraform AWS Provider 5.0.0	active	—	—	—

Root Cause

AWS KMS requires a mandatory waiting period (default 7-30 days) after scheduling key deletion before the key is actually deleted; attempting to delete immediately or within the waiting period results in a failure.

generic

中文

AWS KMS要求在计划删除密钥后必须等待一个强制等待期（默认7-30天）才能实际删除密钥；在等待期内尝试删除会导致失败。

Official Documentation

https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html

Workarounds

95% success Schedule key deletion and wait for the waiting period. In AWS CLI: aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7 Then wait 7 days before the key is actually deleted. To cancel deletion, use: aws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
```
Schedule key deletion and wait for the waiting period. In AWS CLI:

aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7

Then wait 7 days before the key is actually deleted. To cancel deletion, use:

aws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
```
90% success Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter: resource "aws_kms_key" "my_key" { description = "Example KMS key" deletion_window_in_days = 7 } Terraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.
```
Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:

resource "aws_kms_key" "my_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 7
}

Terraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.
```
85% success If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.
```
If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.
```

中文步骤

Schedule key deletion and wait for the waiting period. In AWS CLI:

aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7

Then wait 7 days before the key is actually deleted. To cancel deletion, use:

aws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab

Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:

resource "aws_kms_key" "my_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 7
}

Terraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.

If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.

Dead Ends

Common approaches that don't work:

Force delete the key by disabling it first and then deleting 95% fail
Disabling a key does not bypass the deletion waiting period; the key must still be scheduled for deletion and wait.
Use the AWS CLI 'delete-key' command with '--force' flag (which does not exist) 100% fail
The AWS CLI does not have a force delete option for KMS keys; the command will fail with an invalid parameter error.
Delete the CloudFormation stack that created the key, assuming it will cascade delete 80% fail
CloudFormation does not force delete KMS keys; it will schedule deletion and wait, causing stack deletion to hang or fail.