> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Kms unused customer keys remediation ### Triage and Remediation ### Remediation Sure, here are the step-by-step instructions to remediate the issue of an unused Customer Master Key in AWS: 1. Log in to the AWS Management Console. 2. Go to the AWS Key Management Service (KMS) console. 3. In the left navigation pane, select "Customer managed keys." 4. Find the Customer Master Key (CMK) that is not being used and select it. 5. In the "Key state" section, check if the key is enabled or disabled. If the key is enabled, disable it by selecting "Disable key" from the "Actions" dropdown menu. 6. Once the key is disabled, select "Schedule key deletion" from the "Actions" dropdown menu. 7. In the "Schedule key deletion" dialog box, specify the number of days for which you want to retain the key before it is deleted permanently. You can select a minimum of 7 days and a maximum of 30 days. 8. Click on the "Schedule key deletion" button to schedule the deletion of the key. By following these steps, you can remediate the issue of an unused Customer Master Key in AWS and ensure that your cloud environment is secure. # To remediate the misconfiguration of an unused customer master key in AWS using AWS CLI, you can follow these steps: 1. Open your AWS CLI and run the following command to list all the Customer Master Keys (CMKs) in your account: ``` aws kms list-keys ``` This command will return a list of all the CMKs in your account. 2. Identify the unused CMK that you want to remove and make sure that it is not being used by any resources or services in your account. 3. Run the following command to disable the CMK: ``` aws kms disable-key --key-id ``` Replace `` with the ID of the CMK that you want to disable. 4. After disabling the CMK, run the following command to schedule the deletion of the CMK: ``` aws kms schedule-key-deletion --key-id --pending-window-in-days 7 ``` Replace `` with the ID of the CMK that you want to delete and `--pending-window-in-days` with the number of days (between 7 and 30) that you want to wait before the CMK is permanently deleted. 5. Verify that the CMK has been scheduled for deletion by running the following command: ``` aws kms list-scheduled-key-deletions ``` This command will return a list of all the CMKs that are scheduled for deletion. 6. Once the scheduled deletion time has passed, the CMK will be permanently deleted from your account. Note: Before deleting any CMK, it is important to ensure that it is not being used by any resources or services in your account. Deleting a CMK that is being used can cause data loss or service disruption. To remediate the misconfiguration "Unused Customer Master Key Should Be Removed" in AWS using Python, you can follow the below steps: 1. Import the necessary AWS SDKs and modules in Python. 2. Use the AWS Key Management Service (KMS) API to list all the customer master keys (CMKs) in your AWS account. 3. For each CMK, check if it is in use by any AWS resource or service. If not, delete the CMK. 4. To delete a CMK, use the `boto3` Python module to call the `kms.delete_key()` method and pass the CMK ID as a parameter. Here is a sample Python code that can help you remediate the misconfiguration: ```python theme={null} import boto3 # Create a KMS client kms = boto3.client('kms') # List all the customer master keys (CMKs) response = kms.list_keys() # For each CMK, check if it is in use by any AWS resource or service for key in response['Keys']: key_id = key['KeyId'] key_metadata = kms.describe_key(KeyId=key_id) if not key_metadata['KeyMetadata']['Enabled']: # If the CMK is disabled, delete it print(f"Deleting disabled CMK {key_id}...") kms.schedule_key_deletion(KeyId=key_id) elif not key_metadata['KeyMetadata']['KeyUsage']: # If the CMK is not in use, delete it print(f"Deleting unused CMK {key_id}...") kms.schedule_key_deletion(KeyId=key_id) else: print(f"Skipping CMK {key_id}: in use by {key_metadata['KeyMetadata']['KeyUsage']}") print("CMK remediation completed.") ``` Note: Before running the code, make sure you have the necessary AWS credentials and permissions to access the KMS API. Also, make sure to test the code in a non-production environment before implementing it in a production environment. ```hcl theme={null} resource "aws_kms_key" "UNUSED_KMS_KEY" { description = "UNUSED: scheduled for deletion via Terraform destroy" deletion_window_in_days = 7 # Pending window must be between 7 and 30 days # ...any other required arguments (e.g. policy, key_usage, customer_master_key_spec, etc.) } ``` This setting only controls the waiting period that AWS KMS uses when the key is destroyed; Terraform itself cannot “schedule-key-deletion” as a standalone operation. To perform the same remediation as the CLI (`aws kms schedule-key-deletion --pending-window-in-days 7`), you must: 1. Ensure `deletion_window_in_days = 7` on this `aws_kms_key` resource. 2. Remove this resource from your Terraform configuration (or target-destroy it). 3. Run `terraform destroy -target=aws_kms_key.UNUSED_KMS_KEY` so Terraform calls the KMS `ScheduleKeyDeletion` API with a 7‑day window. WARNING: DESTRUCTIVE ACTION: Once you apply the destroy, the key is scheduled for deletion and, after the 7‑day waiting period, all data encrypted with this key will be permanently unrecoverable. Verify the key is truly unused before proceeding. You can still cancel deletion from the AWS Console or via `aws kms cancel-key-deletion` during the waiting period. Changing `deletion_window_in_days` on an existing key forces replacement of the KMS key (destroy + recreate), which is also destructive with respect to any data encrypted under the old key. Verification: `terraform plan` should show the `aws_kms_key.UNUSED_KMS_KEY` resource being destroyed (no replacement) once you have removed it from configuration or targeted it for destroy, with no other changes.