{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "item": { "id": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "slug": "approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext", "url": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext.md", "json": "https://update.dsesecurity.com/api/v1/posts/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/" }, "title": "Approve KMS key deletion only after reviewing dependent ciphertext", "summary": "Use the deletion waiting period as a final dependency review window.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:37+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 253, "potentially_affected": "This concerns scheduling customer managed KMS key deletion, with the specific key-type exceptions in the official reference.", "dse_recommendation": "DSE recommends inventorying application, backup and archive dependencies before scheduling deletion.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Use the deletion waiting period as a final dependency review window.

\n

Source facts

\n

KMS key deletion removes the key and metadata and is generally irreversible. AWS requires a waiting period and prevents cryptographic use while the key is pending deletion. KMS does not maintain an inventory of ciphertext encrypted under a key. Special key types, including multi-Region and imported-key cases, have additional rules.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns scheduling customer managed KMS key deletion, with the specific key-type exceptions in the official reference.

\n

DSE recommendation

\n

DSE recommends inventorying application, backup and archive dependencies before scheduling deletion. Obtain approval from data owners whose recovery relies on the key. Record the actual scheduled date and the person responsible for cancellation if a dependency is discovered. Use a monitored disablement review where appropriate rather than assuming recent inactivity establishes safety. Include externally distributed public keys in the assessment for asymmetric encryption. Keep the evidence and owner decision with the key identifier after the retirement review. Give the retirement decision a named cancellation contact and an escalation deadline before the actual deletion time. Ask archive and backup owners to identify their oldest required recoverable dataset, and record any uncertainty as an unresolved dependency rather than a presumed absence.

\n

Verification

\n

Proposed verification: inspect state and scheduled deletion time, reconcile known dependent datasets, and review any attempted use during the waiting period. Rehearse cancellation on a disposable key if required. Do not delete production keys merely to demonstrate that the procedure works.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Use the deletion waiting period as a final dependency review window.\nSource facts\nKMS key deletion removes the key and metadata and is generally irreversible. AWS requires a waiting period and prevents cryptographic use while the key is pending deletion. KMS does not maintain an inventory of ciphertext encrypted under a key. Special key types, including multi-Region and imported-key cases, have additional rules.\nSource: AWS Documentation.\nApplicability\nThis concerns scheduling customer managed KMS key deletion, with the specific key-type exceptions in the official reference.\nDSE recommendation\nDSE recommends inventorying application, backup and archive dependencies before scheduling deletion. Obtain approval from data owners whose recovery relies on the key. Record the actual scheduled date and the person responsible for cancellation if a dependency is discovered. Use a monitored disablement review where appropriate rather than assuming recent inactivity establishes safety. Include externally distributed public keys in the assessment for asymmetric encryption. Keep the evidence and owner decision with the key identifier after the retirement review. Give the retirement decision a named cancellation contact and an escalation deadline before the actual deletion time. Ask archive and backup owners to identify their oldest required recoverable dataset, and record any uncertainty as an unresolved dependency rather than a presumed absence.\nVerification\nProposed verification: inspect state and scheduled deletion time, reconcile known dependent datasets, and review any attempted use during the waiting period. Rehearse cancellation on a disposable key if required. Do not delete production keys merely to demonstrate that the procedure works.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Use the deletion waiting period as a final dependency review window.\n\n## Source facts\n\nKMS key deletion removes the key and metadata and is generally irreversible. AWS requires a waiting period and prevents cryptographic use while the key is pending deletion. KMS does not maintain an inventory of ciphertext encrypted under a key. Special key types, including multi-Region and imported-key cases, have additional rules.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html).\n\n## Applicability\n\nThis concerns scheduling customer managed KMS key deletion, with the specific key-type exceptions in the official reference.\n\n## DSE recommendation\n\nDSE recommends inventorying application, backup and archive dependencies before scheduling deletion. Obtain approval from data owners whose recovery relies on the key. Record the actual scheduled date and the person responsible for cancellation if a dependency is discovered. Use a monitored disablement review where appropriate rather than assuming recent inactivity establishes safety. Include externally distributed public keys in the assessment for asymmetric encryption. Keep the evidence and owner decision with the key identifier after the retirement review. Give the retirement decision a named cancellation contact and an escalation deadline before the actual deletion time. Ask archive and backup owners to identify their oldest required recoverable dataset, and record any uncertainty as an unresolved dependency rather than a presumed absence.\n\n## Verification\n\nProposed verification: inspect state and scheduled deletion time, reconcile known dependent datasets, and review any attempted use during the waiting period. Rehearse cancellation on a disposable key if required. Do not delete production keys merely to demonstrate that the procedure works.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "url": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Approve KMS key deletion only after reviewing dependent ciphertext", "item": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/#article", "identifier": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "url": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/", "headline": "Approve KMS key deletion only after reviewing dependent ciphertext", "description": "Use the deletion waiting period as a final dependency review window.", "abstract": "Use the deletion waiting period as a final dependency review window.", "articleBody": "Use the deletion waiting period as a final dependency review window.\nSource facts\nKMS key deletion removes the key and metadata and is generally irreversible. AWS requires a waiting period and prevents cryptographic use while the key is pending deletion. KMS does not maintain an inventory of ciphertext encrypted under a key. Special key types, including multi-Region and imported-key cases, have additional rules.\nSource: AWS Documentation.\nApplicability\nThis concerns scheduling customer managed KMS key deletion, with the specific key-type exceptions in the official reference.\nDSE recommendation\nDSE recommends inventorying application, backup and archive dependencies before scheduling deletion. Obtain approval from data owners whose recovery relies on the key. Record the actual scheduled date and the person responsible for cancellation if a dependency is discovered. Use a monitored disablement review where appropriate rather than assuming recent inactivity establishes safety. Include externally distributed public keys in the assessment for asymmetric encryption. Keep the evidence and owner decision with the key identifier after the retirement review. Give the retirement decision a named cancellation contact and an escalation deadline before the actual deletion time. Ask archive and backup owners to identify their oldest required recoverable dataset, and record any uncertainty as an unresolved dependency rather than a presumed absence.\nVerification\nProposed verification: inspect state and scheduled deletion time, reconcile known dependent datasets, and review any attempted use during the waiting period. Rehearse cancellation on a disposable key if required. Do not delete production keys merely to demonstrate that the procedure works.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:37+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/approve-kms-key-deletion-only-after-reviewing-dependent-ciphertext/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Approve KMS key deletion only after reviewing dependent ciphertext" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 253, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html" } } ] } }