KMS customer Managed Key Not deleting because AccessDeniedException With Root Account

0

Hello AWS,

I am trying to disable and delete customer managed keys from the console i am getting AccessDeniedException Error. I even created user with required permissions but still the issue persisted.

Saurabh
已提問 1 個月前檢視次數 123 次
3 個答案
1

I have been there before and quickest, easiest approach is to reach out to AWS Support to prove your ownership of the account in order to regain admin access for your key and being able to delete it.

profile picture
專家
已回答 1 個月前
profile picture
專家
已審閱 1 個月前
profile picture
專家
已審閱 1 個月前
1

Hello.

If you are unable to access the KMS key no matter which user you use, you will need to open a case with AWS Support under "Account and billing" and have them take action.
Inquiries under "Account and billing" can be made free of charge.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-default.html

For example, suppose you create a key policy that gives only one user access to the KMS key. If you then delete that user, the key becomes unmanageable and you must contact AWS Support to regain access to the KMS key.

profile picture
專家
已回答 1 個月前
profile picture
專家
已審閱 1 個月前
profile picture
專家
已審閱 1 個月前
0

It would be really helpful if you can post the CloudTrail event where you see the Access Denied, as it will provide a lot of useful information. Anyway, I think that the reason is that you cannot delete the key is because probably the KEY has a key policy (resource policy) which do not grant the permissions to be deleted to that user, yes, even the root user. Another idea could be you have an SCP (if you are in an organization) which avoids this. Also, you need to take into consideration that you cannot delete a key right away, you have a waiting period between 7 and 30 days, so just in case you realize you need to get back the key you can do it, this is a non reversible operation and will render all you data encrypted under this CMK to be unreadable.

Best regards.

profile pictureAWS
已回答 1 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南