All Products
Search

This Product

    Key Management Service:Schedule a key deletion task

    Document Center

    Key Management Service:Schedule a key deletion task

    Last Updated:Jan 22, 2024

    After you delete a customer master key (CMK), you cannot recover the CMK or decrypt the data and ciphertext data keys that are encrypted by using the CMK. To prevent CMKs from being accidentally deleted, KMS allows you to only schedule key deletion tasks. You cannot immediately delete CMKs. This topic describes how to schedule a key deletion task.

    Background information

    After a scheduled deletion period is specified for a CMK, the CMK enters the Pending Deletion state and you are no longer charged for the CMK.

    Note

    The Schedule Key Deletion button for service-managed keys is dimmed. You cannot schedule a key deletion task for a service-managed key. The alias of a service-managed key is in the acs/Service name format.

    Prerequisites

    Before you schedule a key deletion task for a CMK, you must disable deletion protection for the CMK. To disable deletion protection for a CMK, you can click Disable Deletion Protection in the Key Details section of the CMK. In the message that appears, click OK.

    Procedure

    Warning

    The system deletes a key when the scheduled deletion period of the key elapses. After the key is deleted, you cannot decrypt the data that is encrypted by using the key or related data keys. Before you delete a key, make sure that the key is no longer in use. If you delete a key that is in use, your services may become unavailable.

    1. Log on to the KMS console.

    2. In the top navigation bar, select the region in which you want to schedule a key deletion task for a CMK.

    3. In the left-side navigation pane, click Keys.

    4. Find the CMK for which you want to schedule a deletion task, and choose More > Schedule Key Deletion in the Actions column.

    5. In the Schedule Key Deletion dialog box, configure Schedule Deletion Period (7 to 366 Days).

      Valid values of Schedule Deletion Period (7 to 366 Days): 7 to 366. Unit: days. Default value: 366.

    6. Click OK.

      Note

      • The status of the CMK changes from Enabled to Pending Deletion. You cannot use a CMK in the Pending Deletion state to encrypt data, decrypt data, or generate data keys.

      • You can choose More > Cancel Key Deletion in the Actions column to cancel the scheduled key deletion task.