1. Open the AWS Management Console and navigate to the KMS service.
2. In the left navigation pane, click on “Scheduled Deletion”.
3. Check the list of keys scheduled for deletion and identify the key that needs to be recovered.
4. Select the key by clicking on the checkbox next to it.
5. Click on the “Recover” button on the top of the page.
6. In the confirmation dialog box, click on the “Recover” button again to confirm the recovery.
7. Once the key is recovered, it will be available for use again.

​

1. Open the AWS CLI on your local machine.
2. Run the following command to list all the KMS keys that are scheduled for deletion:

aws kms list-grants --key-id <key-id> --query "Grants[?RetiringPrincipal!=''].GrantId"

3. Review the output of the command and identify the Grant IDs of the grants that are scheduled for deletion.
4. Run the following command to recover the grants that are scheduled for deletion:

aws kms retire-grant --key-id <key-id> --grant-id <grant-id>

5. Repeat steps 4 and 5 for all the grants that are scheduled for deletion.
6. Once you have recovered all the grants that were scheduled for deletion, recheck the status of the KMS key to ensure that the issue has been resolved.

1. Import the required Boto3 libraries:

import boto3
from botocore.exceptions import ClientError

2. Create a Boto3 client for the KMS service:

kms_client = boto3.client('kms')

3. Use the list_grants API to get the list of all KMS keys that are scheduled for deletion:

try:
    response = kms_client.list_grants(Filters=[{'Key': 'GrantState', 'Values': ['PendingDeletion']}])
    grants = response['Grants']
except ClientError as e:
    print(f"Error listing KMS grants: {e}")
    grants = []

4. For each grant that is scheduled for deletion, use the cancel_key_deletion API to cancel the scheduled deletion:

for grant in grants:
    try:
        response = kms_client.cancel_key_deletion(KeyId=grant['KeyId'])
        print(f"Cancelled deletion for KMS key {grant['KeyId']}")
    except ClientError as e:
        print(f"Error cancelling deletion for KMS key {grant['KeyId']}: {e}")

# There is no Terraform argument or resource that performs
# `CancelKeyDeletion` on an existing KMS key or changes a key
# from `PendingDeletion` back to `Disabled`/`Enabled`.

# You must recover the key outside Terraform, then manage its
# steady-state in code to avoid re-scheduling deletion.

# Example: desired steady-state of the key once recovered
resource "aws_kms_key" "EXISTING_KEY" {
  key_id                = "EXISTING_KEY_ID_FROM_AWS" # substitute your key ID if using import
  description           = "DESIRED_DESCRIPTION"
  is_enabled            = true                      # keep the key enabled
  deletion_window_in_days = 30                      # DO NOT call schedule deletion in Terraform
  # ...other desired settings...
}

1. In CLI/Console, run the verified fix:
   • aws kms cancel-key-deletion --key-id YOUR_KEY_ID --region YOUR_REGION
   • aws kms enable-key --key-id YOUR_KEY_ID --region YOUR_REGION
   • Heed the warnings: only cancel deletion if it wasn’t intentional.
2. Import the key into Terraform (if not already managed) and ensure your aws_kms_key configuration does not schedule its deletion again:
   • terraform import aws_kms_key.EXISTING_KEY YOUR_KEY_ID

• No changes (if the config matches the recovered key), or
• Only configuration drift being reconciled (description, tags, etc.), and specifically no actions that schedule the key for deletion.