KMS customer Managed Key Not deleting because AccessDeniedException With Root Account

0

Hello AWS,

I am trying to disable and delete customer managed keys from the console i am getting AccessDeniedException Error. I even created user with required permissions but still the issue persisted.

3 Answers
1

I have been there before and quickest, easiest approach is to reach out to AWS Support to prove your ownership of the account in order to regain admin access for your key and being able to delete it.

profile picture
EXPERT
answered a month ago
profile picture
EXPERT
reviewed a month ago
profile picture
EXPERT
reviewed a month ago
1

Hello.

If you are unable to access the KMS key no matter which user you use, you will need to open a case with AWS Support under "Account and billing" and have them take action.
Inquiries under "Account and billing" can be made free of charge.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html

For example, suppose you create a key policy that gives only one user access to the KMS key. If you then delete that user, the key becomes unmanageable and you must contact AWS Support to regain access to the KMS key.

profile picture
EXPERT
answered a month ago
profile picture
EXPERT
reviewed a month ago
profile picture
EXPERT
reviewed a month ago
0

It would be really helpful if you can post the CloudTrail event where you see the Access Denied, as it will provide a lot of useful information. Anyway, I think that the reason is that you cannot delete the key is because probably the KEY has a key policy (resource policy) which do not grant the permissions to be deleted to that user, yes, even the root user. Another idea could be you have an SCP (if you are in an organization) which avoids this. Also, you need to take into consideration that you cannot delete a key right away, you have a waiting period between 7 and 30 days, so just in case you realize you need to get back the key you can do it, this is a non reversible operation and will render all you data encrypted under this CMK to be unreadable.

Best regards.

profile pictureAWS
answered a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions