> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kms scheduled deletion remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Sure, here are the step by step instructions to remediate the KMS Keys Scheduled for Deletion should be recovered misconfiguration in AWS using the AWS console:

        1. Open the AWS Management Console and navigate to the KMS service.

        2. In the left navigation pane, click on "Scheduled Deletion".

        3. Check the list of keys scheduled for deletion and identify the key that needs to be recovered.

        4. Select the key by clicking on the checkbox next to it.

        5. Click on the "Recover" button on the top of the page.

        6. In the confirmation dialog box, click on the "Recover" button again to confirm the recovery.

        7. Once the key is recovered, it will be available for use again.

        That's it! You have successfully remediated the KMS Keys Scheduled for Deletion should be recovered misconfiguration in AWS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        Sure, here are the step-by-step instructions to remediate the KMS Keys Scheduled for Deletion should be Recovered issue in AWS using AWS CLI:

        1. Open the AWS CLI on your local machine.

        2. Run the following command to list all the KMS keys that are scheduled for deletion:

        ```
        aws kms list-grants --key-id <key-id> --query "Grants[?RetiringPrincipal!=''].GrantId"
        ```

        Note: Replace `<key-id>` with the ID of the KMS key that is scheduled for deletion.

        3. Review the output of the command and identify the Grant IDs of the grants that are scheduled for deletion.

        4. Run the following command to recover the grants that are scheduled for deletion:

        ```
        aws kms retire-grant --key-id <key-id> --grant-id <grant-id>
        ```

        Note: Replace `<key-id>` with the ID of the KMS key that is scheduled for deletion and `<grant-id>` with the ID of the grant that you want to recover.

        5. Repeat steps 4 and 5 for all the grants that are scheduled for deletion.

        6. Once you have recovered all the grants that were scheduled for deletion, recheck the status of the KMS key to ensure that the issue has been resolved.

        That's it! These steps should help you remediate the KMS Keys Scheduled for Deletion should be Recovered issue in AWS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate this issue in AWS using Python, you can use the AWS SDK for Python (Boto3) to recover the KMS keys that are scheduled for deletion. Here are the steps to do so:

        1. Import the required Boto3 libraries:

        ```python theme={null}
        import boto3
        from botocore.exceptions import ClientError
        ```

        2. Create a Boto3 client for the KMS service:

        ```python theme={null}
        kms_client = boto3.client('kms')
        ```

        3. Use the `list_grants` API to get the list of all KMS keys that are scheduled for deletion:

        ```python theme={null}
        try:
            response = kms_client.list_grants(Filters=[{'Key': 'GrantState', 'Values': ['PendingDeletion']}])
            grants = response['Grants']
        except ClientError as e:
            print(f"Error listing KMS grants: {e}")
            grants = []
        ```

        4. For each grant that is scheduled for deletion, use the `cancel_key_deletion` API to cancel the scheduled deletion:

        ```python theme={null}
        for grant in grants:
            try:
                response = kms_client.cancel_key_deletion(KeyId=grant['KeyId'])
                print(f"Cancelled deletion for KMS key {grant['KeyId']}")
            except ClientError as e:
                print(f"Error cancelling deletion for KMS key {grant['KeyId']}: {e}")
        ```

        This Python script will cancel the scheduled deletion for all KMS keys that are in the "PendingDeletion" state. You can run this script periodically to ensure that any KMS keys that are scheduled for deletion are recovered.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # There is no Terraform argument or resource that performs
        # `CancelKeyDeletion` on an existing KMS key or changes a key
        # from `PendingDeletion` back to `Disabled`/`Enabled`.

        # You must recover the key outside Terraform, then manage its
        # steady-state in code to avoid re-scheduling deletion.

        # Example: desired steady-state of the key once recovered
        resource "aws_kms_key" "EXISTING_KEY" {
          key_id                = "EXISTING_KEY_ID_FROM_AWS" # substitute your key ID if using import
          description           = "DESIRED_DESCRIPTION"
          is_enabled            = true                      # keep the key enabled
          deletion_window_in_days = 30                      # DO NOT call schedule deletion in Terraform
          # ...other desired settings...
        }
        ```

        AWS KMS key recovery from a `PendingDeletion` state (the `aws kms cancel-key-deletion` and subsequent `aws kms enable-key` operations) is not exposed by the Terraform AWS provider, so it cannot be remediated directly in Terraform; you must:

        1. In CLI/Console, run the verified fix:
           * `aws kms cancel-key-deletion --key-id YOUR_KEY_ID --region YOUR_REGION`
           * `aws kms enable-key --key-id YOUR_KEY_ID --region YOUR_REGION`
           * Heed the warnings: only cancel deletion if it wasn’t intentional.

        2. Import the key into Terraform (if not already managed) and ensure your `aws_kms_key` configuration does not schedule its deletion again:
           * `terraform import aws_kms_key.EXISTING_KEY YOUR_KEY_ID`

        `terraform plan` should then show either:

        * No changes (if the config matches the recovered key), or
        * Only configuration drift being reconciled (description, tags, etc.), and specifically no actions that schedule the key for deletion.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>