KMS customer Managed Key Not deleting because AccessDeniedException With Root Account

0

Hello AWS,

I am trying to disable and delete customer managed keys from the console i am getting AccessDeniedException Error. I even created user with required permissions but still the issue persisted.

3 Antworten
1

I have been there before and quickest, easiest approach is to reach out to AWS Support to prove your ownership of the account in order to regain admin access for your key and being able to delete it.

profile picture
EXPERTE
beantwortet vor einem Monat
profile picture
EXPERTE
überprüft vor einem Monat
profile picture
EXPERTE
überprüft vor einem Monat
1

Hello.

If you are unable to access the KMS key no matter which user you use, you will need to open a case with AWS Support under "Account and billing" and have them take action.
Inquiries under "Account and billing" can be made free of charge.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html

For example, suppose you create a key policy that gives only one user access to the KMS key. If you then delete that user, the key becomes unmanageable and you must contact AWS Support to regain access to the KMS key.

profile picture
EXPERTE
beantwortet vor einem Monat
profile picture
EXPERTE
überprüft vor einem Monat
profile picture
EXPERTE
überprüft vor einem Monat
0

It would be really helpful if you can post the CloudTrail event where you see the Access Denied, as it will provide a lot of useful information. Anyway, I think that the reason is that you cannot delete the key is because probably the KEY has a key policy (resource policy) which do not grant the permissions to be deleted to that user, yes, even the root user. Another idea could be you have an SCP (if you are in an organization) which avoids this. Also, you need to take into consideration that you cannot delete a key right away, you have a waiting period between 7 and 30 days, so just in case you realize you need to get back the key you can do it, this is a non reversible operation and will render all you data encrypted under this CMK to be unreadable.

Best regards.

profile pictureAWS
beantwortet vor einem Monat

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen