After you create a CMK, it is in the Enabled state by default. This topic describes how to disable a CMK. A disabled CMK cannot be used for encryption and decryption.
- Log on to the KMS console.
- In the top navigation bar, select the region where the CMK you want to disable resides.
- In the left-side navigation pane, click Keys.
- Find the CMK that you want to disable and click Disable in the Actions column.
- In the Disable Key message, click OK.