1. Log in to the AWS Management Console.
2. Go to the AWS Key Management Service (KMS) console.
3. In the left navigation pane, select “Customer managed keys.”
4. Find the Customer Master Key (CMK) that is not being used and select it.
5. In the “Key state” section, check if the key is enabled or disabled. If the key is enabled, disable it by selecting “Disable key” from the “Actions” dropdown menu.
6. Once the key is disabled, select “Schedule key deletion” from the “Actions” dropdown menu.
7. In the “Schedule key deletion” dialog box, specify the number of days for which you want to retain the key before it is deleted permanently. You can select a minimum of 7 days and a maximum of 30 days.
8. Click on the “Schedule key deletion” button to schedule the deletion of the key.

​

1. Open your AWS CLI and run the following command to list all the Customer Master Keys (CMKs) in your account:
   aws kms list-keys
   
   This command will return a list of all the CMKs in your account.
2. Identify the unused CMK that you want to remove and make sure that it is not being used by any resources or services in your account.
3. Run the following command to disable the CMK:
   aws kms disable-key --key-id <key-id>
   
   Replace <key-id> with the ID of the CMK that you want to disable.
4. After disabling the CMK, run the following command to schedule the deletion of the CMK:
   aws kms schedule-key-deletion --key-id <key-id> --pending-window-in-days 7
   
   Replace <key-id> with the ID of the CMK that you want to delete and --pending-window-in-days with the number of days (between 7 and 30) that you want to wait before the CMK is permanently deleted.
5. Verify that the CMK has been scheduled for deletion by running the following command:
   aws kms list-scheduled-key-deletions
   
   This command will return a list of all the CMKs that are scheduled for deletion.
6. Once the scheduled deletion time has passed, the CMK will be permanently deleted from your account.

1. Import the necessary AWS SDKs and modules in Python.
2. Use the AWS Key Management Service (KMS) API to list all the customer master keys (CMKs) in your AWS account.
3. For each CMK, check if it is in use by any AWS resource or service. If not, delete the CMK.
4. To delete a CMK, use the boto3 Python module to call the kms.delete_key() method and pass the CMK ID as a parameter.

import boto3

# Create a KMS client
kms = boto3.client('kms')

# List all the customer master keys (CMKs)
response = kms.list_keys()

# For each CMK, check if it is in use by any AWS resource or service
for key in response['Keys']:
    key_id = key['KeyId']
    key_metadata = kms.describe_key(KeyId=key_id)

    if not key_metadata['KeyMetadata']['Enabled']:
        # If the CMK is disabled, delete it
        print(f"Deleting disabled CMK {key_id}...")
        kms.schedule_key_deletion(KeyId=key_id)
    elif not key_metadata['KeyMetadata']['KeyUsage']:
        # If the CMK is not in use, delete it
        print(f"Deleting unused CMK {key_id}...")
        kms.schedule_key_deletion(KeyId=key_id)
    else:
        print(f"Skipping CMK {key_id}: in use by {key_metadata['KeyMetadata']['KeyUsage']}")

print("CMK remediation completed.")

resource "aws_kms_key" "UNUSED_KMS_KEY" {
  description             = "UNUSED: scheduled for deletion via Terraform destroy"
  deletion_window_in_days = 7 # Pending window must be between 7 and 30 days

  # ...any other required arguments (e.g. policy, key_usage, customer_master_key_spec, etc.)
}

1. Ensure deletion_window_in_days = 7 on this aws_kms_key resource.
2. Remove this resource from your Terraform configuration (or target-destroy it).
3. Run terraform destroy -target=aws_kms_key.UNUSED_KMS_KEY so Terraform calls the KMS ScheduleKeyDeletion API with a 7‑day window.