{
  "id": "security/aws-kms-key-deletion-without-wait-period",
  "signature": "AWS KMS key deletion failed due to pending deletion without waiting period",
  "signature_zh": "AWS KMS密钥删除失败，因未等待待删除期结束",
  "regex": "KMSInvalidStateException.*pending deletion|Key.*is pending deletion|cannot delete.*key.*in.*state",
  "domain": "security",
  "category": "resource_error",
  "subcategory": null,
  "root_cause": "AWS KMS requires a mandatory waiting period (default 7-30 days) after scheduling key deletion before the key is actually deleted; attempting to delete immediately or within the waiting period results in a failure.",
  "root_cause_type": "generic",
  "root_cause_zh": "AWS KMS要求在计划删除密钥后必须等待一个强制等待期（默认7-30天）才能实际删除密钥；在等待期内尝试删除会导致失败。",
  "versions": [
    {
      "version": "AWS KMS API 2014-11-01",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "AWS SDK for Python (boto3) 1.26.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "AWS CLI 2.x",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Terraform AWS Provider 5.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Force delete the key by disabling it first and then deleting",
      "why_fails": "Disabling a key does not bypass the deletion waiting period; the key must still be scheduled for deletion and wait.",
      "fail_rate": 0.95,
      "condition": "",
      "sources": []
    },
    {
      "action": "Use the AWS CLI 'delete-key' command with '--force' flag (which does not exist)",
      "why_fails": "The AWS CLI does not have a force delete option for KMS keys; the command will fail with an invalid parameter error.",
      "fail_rate": 1.0,
      "condition": "",
      "sources": []
    },
    {
      "action": "Delete the CloudFormation stack that created the key, assuming it will cascade delete",
      "why_fails": "CloudFormation does not force delete KMS keys; it will schedule deletion and wait, causing stack deletion to hang or fail.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Schedule key deletion and wait for the waiting period. In AWS CLI:\n\naws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7\n\nThen wait 7 days before the key is actually deleted. To cancel deletion, use:\n\naws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab",
      "success_rate": 0.95,
      "how": "Schedule key deletion and wait for the waiting period. In AWS CLI:\n\naws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7\n\nThen wait 7 days before the key is actually deleted. To cancel deletion, use:\n\naws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:\n\nresource \"aws_kms_key\" \"my_key\" {\n  description             = \"Example KMS key\"\n  deletion_window_in_days = 7\n}\n\nTerraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.",
      "success_rate": 0.9,
      "how": "Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:\n\nresource \"aws_kms_key\" \"my_key\" {\n  description             = \"Example KMS key\"\n  deletion_window_in_days = 7\n}\n\nTerraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.",
      "success_rate": 0.85,
      "how": "If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Schedule key deletion and wait for the waiting period. In AWS CLI:\n\naws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7\n\nThen wait 7 days before the key is actually deleted. To cancel deletion, use:\n\naws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab",
    "Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:\n\nresource \"aws_kms_key\" \"my_key\" {\n  description             = \"Example KMS key\"\n  deletion_window_in_days = 7\n}\n\nTerraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.",
    "If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html",
  "official_doc_section": null,
  "error_code": "KMSInvalidStateException",
  "verification_tier": "ai_generated",
  "confidence": 0.88,
  "fix_success_rate": 0.92,
  "resolvable": "true",
  "first_seen": "2023-11-10",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}