KMS customer Managed Key Not deleting because AccessDeniedException With Root Account

0

Hello AWS,

I am trying to disable and delete customer managed keys from the console i am getting AccessDeniedException Error. I even created user with required permissions but still the issue persisted.

3回答
1

I have been there before and quickest, easiest approach is to reach out to AWS Support to prove your ownership of the account in order to regain admin access for your key and being able to delete it.

profile picture
エキスパート
回答済み 1ヶ月前
profile picture
エキスパート
レビュー済み 1ヶ月前
profile picture
エキスパート
レビュー済み 1ヶ月前
1

Hello.

If you are unable to access the KMS key no matter which user you use, you will need to open a case with AWS Support under "Account and billing" and have them take action.
Inquiries under "Account and billing" can be made free of charge.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html

For example, suppose you create a key policy that gives only one user access to the KMS key. If you then delete that user, the key becomes unmanageable and you must contact AWS Support to regain access to the KMS key.

profile picture
エキスパート
回答済み 1ヶ月前
profile picture
エキスパート
レビュー済み 1ヶ月前
profile picture
エキスパート
レビュー済み 1ヶ月前
0

It would be really helpful if you can post the CloudTrail event where you see the Access Denied, as it will provide a lot of useful information. Anyway, I think that the reason is that you cannot delete the key is because probably the KEY has a key policy (resource policy) which do not grant the permissions to be deleted to that user, yes, even the root user. Another idea could be you have an SCP (if you are in an organization) which avoids this. Also, you need to take into consideration that you cannot delete a key right away, you have a waiting period between 7 and 30 days, so just in case you realize you need to get back the key you can do it, this is a non reversible operation and will render all you data encrypted under this CMK to be unreadable.

Best regards.

profile pictureAWS
回答済み 1ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ