Approve KMS key deletion only after reviewing dependent ciphertext

Use the deletion waiting period as a final dependency review window.

Source facts

KMS key deletion removes the key and metadata and is generally irreversible. AWS requires a waiting period and prevents cryptographic use while the key is pending deletion. KMS does not maintain an inventory of ciphertext encrypted under a key. Special key types, including multi-Region and imported-key cases, have additional rules.

Source: AWS Documentation.

Applicability

This concerns scheduling customer managed KMS key deletion, with the specific key-type exceptions in the official reference.

DSE recommendation

DSE recommends inventorying application, backup and archive dependencies before scheduling deletion. Obtain approval from data owners whose recovery relies on the key. Record the actual scheduled date and the person responsible for cancellation if a dependency is discovered. Use a monitored disablement review where appropriate rather than assuming recent inactivity establishes safety. Include externally distributed public keys in the assessment for asymmetric encryption. Keep the evidence and owner decision with the key identifier after the retirement review. Give the retirement decision a named cancellation contact and an escalation deadline before the actual deletion time. Ask archive and backup owners to identify their oldest required recoverable dataset, and record any uncertainty as an unresolved dependency rather than a presumed absence.

Verification

Proposed verification: inspect state and scheduled deletion time, reconcile known dependent datasets, and review any attempted use during the waiting period. Rehearse cancellation on a disposable key if required. Do not delete production keys merely to demonstrate that the procedure works.

Official reference

AWS Documentation. Reviewed October 20, 2026.