KMS customer managed keys aren't being deleted with my AWS root account.

Question

KMS customer managed keys aren't being deleted with my AWS root account.
I tried to change the policy to delete the key, but my AWS account does not have the PutKeyPolicy permission, so I can't change the policy either.

I'd be grateful if you could help me on what to do.

Unnecessary expenses continue to arise.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Allow access for all principals in the account that are authorized",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890123:root"
            },
            "Action": [
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:Encrypt",
                "kms:DescribeKey",
                "kms:Decrypt",
                "kms:CreateGrant"
            ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "kms:ViaService": "eks.eu-north-1.amazonaws.com",
                    "kms:CallerAccount": "1234567890123"
                }
            }
        },
        {
            "Sid": "Allow direct access to key metadata to the account",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::1234567890123:root"
            },
            "Action": [
                "kms:RevokeGrant",
                "kms:List*",
                "kms:Get*",
                "kms:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow access for Key Administrators",
            "Effect": "Allow",
            "Principal": {
                "AWS": "AROA4UHUGSEYYKGM6DZJP"
            },
            "Action": "kms:*",
            "Resource": "*"
        },
        {
            "Sid": "Allow use of the key",
            "Effect": "Allow",
            "Principal": {
                "AWS": "AROA4UHUGSEYTGJOEARN3"
            },
            "Action": [
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:Encrypt",
                "kms:DescribeKey",
                "kms:Decrypt"
            ],
            "Resource": "*"
        },
        {
            "Sid": "Allow attachment of persistent resources",
            "Effect": "Allow",
            "Principal": {
                "AWS": "AROA4UHUGSEYTGJOEARN3"
            },
            "Action": [
                "kms:RevokeGrant",
                "kms:ListGrants",
                "kms:CreateGrant"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        }
    ]
}

Answer

You might of locked yourself out of your key by not having PutKeyPolicy permission. It seems like there's a SID for "Allow access for Key Administrators" that would of allowed it but not sure if the role/user tied to the principal is in your control. You will need to reach out to AWS Support to prove your ownership of the account in order to regain admin access for your key.

Answer

If I delete the account itself without requesting AWS Support, will the KMS key be deleted as well?

KMS customer managed keys aren't being deleted with my AWS root account.

Relevanter Inhalt