After you create a CMK, it is in the Enabled state by default. This topic describes how to disable a CMK. A disabled CMK cannot be used for encryption and decryption.
Procedure
Log on to the KMS console.
In the top navigation bar, select the region where the CMK you want to disable resides.
In the left-side navigation pane, choose Resource > Keys.
Find the CMK that you want to disable and click Disable in the Actions column.
In the Disable Key message, click OK.
Result
After you disable the CMK, its state changes from Enabled to Disabled.