Unused Customer Master Key Should Be Removed
More Info:
Any disabled KMS Customer Master Keys in your AWS account should be removed in order to lower the cost of your monthly AWS bill.Risk Level
MediumAddress
Operational Maturity, Cost optimization, SecurityCompliance Standards
NISTTriage and Remediation
Remediation
Using Console
Using Console
Sure, here are the step-by-step instructions to remediate the issue of an unused Customer Master Key in AWS:
- Log in to the AWS Management Console.
- Go to the AWS Key Management Service (KMS) console.
- In the left navigation pane, select “Customer managed keys.”
- Find the Customer Master Key (CMK) that is not being used and select it.
- In the “Key state” section, check if the key is enabled or disabled. If the key is enabled, disable it by selecting “Disable key” from the “Actions” dropdown menu.
- Once the key is disabled, select “Schedule key deletion” from the “Actions” dropdown menu.
- In the “Schedule key deletion” dialog box, specify the number of days for which you want to retain the key before it is deleted permanently. You can select a minimum of 7 days and a maximum of 30 days.
- Click on the “Schedule key deletion” button to schedule the deletion of the key.
Using CLI
Using CLI
To remediate the misconfiguration of an unused customer master key in AWS using AWS CLI, you can follow these steps:
-
Open your AWS CLI and run the following command to list all the Customer Master Keys (CMKs) in your account:
This command will return a list of all the CMKs in your account.
- Identify the unused CMK that you want to remove and make sure that it is not being used by any resources or services in your account.
-
Run the following command to disable the CMK:
Replace
<key-id>with the ID of the CMK that you want to disable. -
After disabling the CMK, run the following command to schedule the deletion of the CMK:
Replace
<key-id>with the ID of the CMK that you want to delete and--pending-window-in-dayswith the number of days (between 7 and 30) that you want to wait before the CMK is permanently deleted. -
Verify that the CMK has been scheduled for deletion by running the following command:
This command will return a list of all the CMKs that are scheduled for deletion.
- Once the scheduled deletion time has passed, the CMK will be permanently deleted from your account.
Using Python
Using Python
To remediate the misconfiguration “Unused Customer Master Key Should Be Removed” in AWS using Python, you can follow the below steps:Note: Before running the code, make sure you have the necessary AWS credentials and permissions to access the KMS API. Also, make sure to test the code in a non-production environment before implementing it in a production environment.
- Import the necessary AWS SDKs and modules in Python.
- Use the AWS Key Management Service (KMS) API to list all the customer master keys (CMKs) in your AWS account.
- For each CMK, check if it is in use by any AWS resource or service. If not, delete the CMK.
- To delete a CMK, use the
boto3Python module to call thekms.delete_key()method and pass the CMK ID as a parameter.