Key Management Service:ScheduleKeyDeletion

During the scheduled period, the CMK is in the PendingDeletion state and cannot be used to encrypt data, decrypt data, or generate data keys.

After a CMK is deleted, it cannot be recovered. Data encrypted by the CMK and data keys generated by the CMK cannot be decrypted. To prevent accidental deletion, KMS supports only scheduled key deletion, not direct deletion. If you want to delete a CMK, call the DisableKey operation to disable the CMK.

You must specify a waiting period of 7 to 366 days. The waiting period starts from the time you submit the request. You can call the CancelKeyDeletion operation to cancel the key deletion task before the waiting period ends.

For details about the required RAM access policy, see Resource Access Management.