Ensuring Data Access: Key Management and Backup Strategies

Question

Hi everyone, AWS mentioned that If the customer-managed key is accidentally deleted, we will lose access to encrypted data. right? 
1-do you have any opinion for backup strategy? 
2-How do we guarantee no data access loss in case of accidental key deletion?

gokul_guna · Answer

Hello,

* After a KMS key is deleted, you can no longer decrypt the data that was encrypted under that KMS key, which means that data becomes unrecoverable.

* You should delete a KMS key only when you are sure that you don't need to use it anymore. If you are not sure, consider disabling the KMS key instead of deleting it. You can re-enable a disabled KMS key and cancel the scheduled deletion of a KMS key, but you cannot recover a deleted KMS key.

* Restrict the key deletion access through IAM policies.

refer to below documentation regarding scheduling & deleting customer managed key.

[Deleting AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html)

[Scheduling and canceling key deletion](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-scheduling-key-deletion.html)

Ensuring Data Access: Key Management and Backup Strategies

Add your answer

Relevant content