After you create a CMK, it is in the Enabled state by default. This topic describes how to disable a CMK. A disabled CMK cannot be used for encryption and decryption.


  1. Log on to the KMS console.
  2. In the top navigation bar, select the region where the CMK you want to disable resides.
  3. In the left-side navigation pane, click Keys.
  4. Find the CMK that you want to disable and click Disable in the Actions column.
  5. In the Disable Key message, click OK.


After you disable the CMK, its state changes from Enabled to Disabled.