Cmk Disabled Or Scheduled For Deletion Alarm Remediation

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the CMK Disabled or Scheduled for Deletion alarm in AWS using the AWS console, you can follow the below steps:

Login to your AWS account and navigate to the AWS KMS console.
Click on the "Customer managed keys" option from the left-hand side menu.
Identify the key that is disabled or scheduled for deletion.
To enable a disabled key, select the key and click on the "Enable" button from the top menu.
To cancel the scheduled deletion of a key, select the key and click on the "Cancel key deletion" button from the top menu.
After completing the above steps, verify that the key status has changed to "Enabled" or "Pending import" and the alarm should automatically clear.
If the alarm does not clear, check the SNS topic that is associated with the alarm to ensure that it is configured correctly.

By following these steps, you can remediate the CMK Disabled or Scheduled for Deletion alarm in AWS using the AWS console.

Using CLI

The CMK (Customer Master Key) Disabled or Scheduled for Deletion alarm indicates that a CMK in AWS has been disabled or scheduled for deletion. This misconfiguration can lead to data loss or unauthorized access to encrypted data. Here are the steps to remediate this issue using AWS CLI:

Identify the CMK that has been disabled or scheduled for deletion. You can use the following command to list all the CMKs in your AWS account:

aws kms list-keys

Check the status of each CMK to identify the one that has been disabled or scheduled for deletion. You can use the following command to describe the key state of a CMK:

aws kms describe-key --key-id <key-id>

Replace <key-id> with the ID of the CMK that you want to check.

Reactivate the disabled CMK or cancel the scheduled deletion of the CMK. You can use the following command to enable a disabled CMK:

aws kms enable-key --key-id <key-id>

Replace <key-id> with the ID of the disabled CMK that you want to enable.

If the CMK has been scheduled for deletion, you can cancel the deletion using the following command:

aws kms cancel-key-deletion --key-id <key-id>

Replace <key-id> with the ID of the CMK that you want to cancel the deletion for.

Verify that the CMK is active and not scheduled for deletion. You can use the following command to describe the key state of the CMK again:

aws kms describe-key --key-id <key-id>

Replace <key-id> with the ID of the CMK that you want to verify.

Once you have completed these steps, the CMK Disabled or Scheduled for Deletion alarm should be resolved. It is recommended to regularly monitor your AWS account for this type of misconfiguration and take necessary actions to remediate it.

Using Python

To remediate the CMK Disabled or Scheduled for Deletion Alarm in AWS using Python, you can follow the below steps:

First, you need to check the status of the CMK using the describe_key method of the AWS KMS client. This method returns the metadata for the specified customer master key (CMK).
```
import boto3

# Create a KMS client
kms = boto3.client('kms')

# Get the CMK metadata
key_id = 'your-cmk-id'
key_metadata = kms.describe_key(KeyId=key_id)
```

Check the KeyState attribute of the CMK metadata. If it is set to Disabled or PendingDeletion, then the CMK is disabled or scheduled for deletion.

key_state = key_metadata['KeyMetadata']['KeyState']

if key_state == 'Disabled':
    # Enable the CMK
    kms.enable_key(KeyId=key_id)
    print('CMK enabled successfully.')
elif key_state == 'PendingDeletion':
    # Cancel the scheduled deletion of the CMK
    kms.cancel_key_deletion(KeyId=key_id)
    print('Scheduled deletion of CMK cancelled successfully.')
else:
    print('CMK is already enabled and not scheduled for deletion.')

If the KeyState attribute is not set to Disabled or PendingDeletion, then the CMK is already enabled and not scheduled for deletion.
```
else:
    print('CMK is already enabled and not scheduled for deletion.')
```

By following these steps, you can remediate the CMK Disabled or Scheduled for Deletion Alarm in AWS using Python.

Using Terraform

resource "aws_cloudwatch_metric_alarm" "cmk_disabled_or_scheduled_for_deletion" {
  # CloudWatch alarm that fires when the metric tracking
  # CMK DisableKey / ScheduleKeyDeletion API calls is >= 1

  alarm_name          = "cmk-disabled-or-scheduled-for-deletion"
  alarm_description   = "Alert when a KMS CMK is disabled or scheduled for deletion."
  comparison_operator = "GreaterThanOrEqualToThreshold"
  evaluation_periods  = 1
  datapoints_to_alarm = 1
  threshold           = 1

  metric_name = "CMKDisabledOrScheduledForDeletion" # REPLACE with the metric name from your CloudWatch log metric filter
  namespace   = "KMS/CIS"                           # REPLACE with the metric namespace used by your filter
  statistic   = "Sum"
  period      = 300                                 # 5 minutes; REPLACE if you need a different period

  treat_missing_data = "notBreaching"

  alarm_actions = [
    "arn:aws:sns:AWS_REGION:ACCOUNT_ID:CMK_ALERTS_TOPIC", # REPLACE with your SNS topic ARN for notifications
  ]

  ok_actions = [
    "arn:aws:sns:AWS_REGION:ACCOUNT_ID:CMK_ALERTS_TOPIC", # REPLACE with your SNS topic ARN for notifications
  ]

  dimensions = {
    # OPTIONALLY scope the alarm to a specific CMK:
    # "KeyId" = "CMK_KEY_ID"  # REPLACE with your CMK KeyId if you want per-key alarms
  }
}

If this alarm targets an existing metric filter that already emits 1 whenever DisableKey or ScheduleKeyDeletion is logged, this change does not force replacement of any other resources and is safe to apply.

Verification: terraform plan should show a new aws_cloudwatch_metric_alarm.cmk_disabled_or_scheduled_for_deletion resource being created (or its threshold/evaluation settings updated) with comparison_operator = "GreaterThanOrEqualToThreshold" and threshold = 1 on your CMK disable/schedule‑for‑deletion metric.

Triage and Remediation​

Remediation​

Triage and Remediation

Remediation