KMS customer Managed Key Not deleting because AccessDeniedException With Root Account

0

Hello AWS,

I am trying to disable and delete customer managed keys from the console i am getting AccessDeniedException Error. I even created user with required permissions but still the issue persisted.

Saurabh
질문됨 한 달 전124회 조회
3개 답변
1

I have been there before and quickest, easiest approach is to reach out to AWS Support to prove your ownership of the account in order to regain admin access for your key and being able to delete it.

profile picture
전문가
답변함 한 달 전
profile picture
전문가
검토됨 한 달 전
profile picture
전문가
검토됨 한 달 전
1

Hello.

If you are unable to access the KMS key no matter which user you use, you will need to open a case with AWS Support under "Account and billing" and have them take action.
Inquiries under "Account and billing" can be made free of charge.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html

For example, suppose you create a key policy that gives only one user access to the KMS key. If you then delete that user, the key becomes unmanageable and you must contact AWS Support to regain access to the KMS key.

profile picture
전문가
답변함 한 달 전
profile picture
전문가
검토됨 한 달 전
profile picture
전문가
검토됨 한 달 전
0

It would be really helpful if you can post the CloudTrail event where you see the Access Denied, as it will provide a lot of useful information. Anyway, I think that the reason is that you cannot delete the key is because probably the KEY has a key policy (resource policy) which do not grant the permissions to be deleted to that user, yes, even the root user. Another idea could be you have an SCP (if you are in an organization) which avoids this. Also, you need to take into consideration that you cannot delete a key right away, you have a waiting period between 7 and 30 days, so just in case you realize you need to get back the key you can do it, this is a non reversible operation and will render all you data encrypted under this CMK to be unreadable.

Best regards.

profile pictureAWS
답변함 한 달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠