# AWS KMS key deletion failed due to pending deletion without waiting period

- **ID:** `security/aws-kms-key-deletion-without-wait-period`
- **Domain:** security
- **Category:** resource_error
- **Error Code:** `KMSInvalidStateException`
- **Verification:** ai_generated
- **Fix Rate:** 92%

## Root Cause

AWS KMS requires a mandatory waiting period (default 7-30 days) after scheduling key deletion before the key is actually deleted; attempting to delete immediately or within the waiting period results in a failure.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| AWS KMS API 2014-11-01 | active | — | — |
| AWS SDK for Python (boto3) 1.26.0 | active | — | — |
| AWS CLI 2.x | active | — | — |
| Terraform AWS Provider 5.0.0 | active | — | — |

## Workarounds

1. **Schedule key deletion and wait for the waiting period. In AWS CLI:

aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7

Then wait 7 days before the key is actually deleted. To cancel deletion, use:

aws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab** (95% success)
   ```
   Schedule key deletion and wait for the waiting period. In AWS CLI:

aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7

Then wait 7 days before the key is actually deleted. To cancel deletion, use:

aws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
   ```
2. **Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:

resource "aws_kms_key" "my_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 7
}

Terraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.** (90% success)
   ```
   Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:

resource "aws_kms_key" "my_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 7
}

Terraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.
   ```
3. **If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.** (85% success)
   ```
   If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.
   ```

## Dead Ends

- **Force delete the key by disabling it first and then deleting** — Disabling a key does not bypass the deletion waiting period; the key must still be scheduled for deletion and wait. (95% fail)
- **Use the AWS CLI 'delete-key' command with '--force' flag (which does not exist)** — The AWS CLI does not have a force delete option for KMS keys; the command will fail with an invalid parameter error. (100% fail)
- **Delete the CloudFormation stack that created the key, assuming it will cascade delete** — CloudFormation does not force delete KMS keys; it will schedule deletion and wait, causing stack deletion to hang or fail. (80% fail)