# AWS KMS密钥删除失败，因未等待待删除期结束

- **ID:** `security/aws-kms-key-deletion-without-wait-period`
- **领域:** security
- **类别:** resource_error
- **错误码:** `KMSInvalidStateException`
- **验证级别:** ai_generated
- **修复率:** 92%

## 根因

AWS KMS要求在计划删除密钥后必须等待一个强制等待期（默认7-30天）才能实际删除密钥；在等待期内尝试删除会导致失败。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| AWS KMS API 2014-11-01 | active | — | — |
| AWS SDK for Python (boto3) 1.26.0 | active | — | — |
| AWS CLI 2.x | active | — | — |
| Terraform AWS Provider 5.0.0 | active | — | — |

## 解决方案

1. ```
   Schedule key deletion and wait for the waiting period. In AWS CLI:

aws kms schedule-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab --pending-window-in-days 7

Then wait 7 days before the key is actually deleted. To cancel deletion, use:

aws kms cancel-key-deletion --key-id 1234abcd-12ab-34cd-56ef-1234567890ab
   ```
2. ```
   Use Terraform to manage key lifecycle with a 'deletion_window_in_days' parameter:

resource "aws_kms_key" "my_key" {
  description             = "Example KMS key"
  deletion_window_in_days = 7
}

Terraform will schedule deletion and wait, but you must ensure the resource is destroyed after the window.
   ```
3. ```
   If immediate deletion is required, create a new key and rotate usage to it, then schedule the old key for deletion. This avoids downtime while waiting for the deletion period.
   ```

## 无效尝试

- **Force delete the key by disabling it first and then deleting** — Disabling a key does not bypass the deletion waiting period; the key must still be scheduled for deletion and wait. (95% 失败率)
- **Use the AWS CLI 'delete-key' command with '--force' flag (which does not exist)** — The AWS CLI does not have a force delete option for KMS keys; the command will fail with an invalid parameter error. (100% 失败率)
- **Delete the CloudFormation stack that created the key, assuming it will cascade delete** — CloudFormation does not force delete KMS keys; it will schedule deletion and wait, causing stack deletion to hang or fail. (80% 失败率)