A Key Management Service (KMS) customer master key (CMK) whose status is not set to pending deletion is considered compliant.
Scenarios
Enable this rule to ensure that no in-use CMK is set to pending deletion, preventing business disruption caused by accidental key deletion.
Risk level
Default risk level: medium.
You can change the risk level based on your business requirements when you configure this rule.
Compliance evaluation logic
- If the status of an in-use CMK is not set to pending deletion, the configuration is considered compliant.
- If the status of an in-use CMK is set to pending deletion, the configuration is considered non-compliant. For more information about how to remediate the non-compliant configuration, see Non-compliance remediation.
Rule details
| Item | Description |
| Rule name | kms-key-state-not-pending-deletion |
| Rule ID | kms-key-state-not-pending-deletion |
| Tag | KMS and Secret |
| Automatic remediation | Not supported |
| Trigger type | Configuration change |
| Supported resource type | KMS CMKs |
| Input parameter | None |
Non-compliance remediation
Cancel the scheduled deletion of a CMK. For more information, see Schedule key deletion.