DeleteKey
These examples show the Amazon CloudTrail log entry that is generated when a KMS key is deleted. To delete a KMS key, you use the ScheduleKeyDeletion operation. After the specified waiting period expires, Amazon KMS deletes the KMS key and records an entry like the following one in your CloudTrail log to record that event.
CloudTrail log entries for this operation recorded on or after December 2022 include the key ARN of the affected KMS key in the responseElements.keyId
value, even though this operation does not return the key ARN.
For an example of the CloudTrail log entry for the ScheduleKeyDeletion
operation,
see ScheduleKeyDeletion. For
information about deleting KMS keys, see Deleting Amazon KMS keys.
The following example CloudTrail log entry records a DeleteKey
operation of a
KMS key with key material in Amazon KMS.
{ "eventVersion": "1.08", "userIdentity": { "accountId": "111122223333", "invokedBy": "Amazon Internal" }, "eventTime": "2020-07-31T00:07:00Z", "eventSource": "kms.amazonaws.com", "eventName": "DeleteKey", "awsRegion": "us-east-1", "sourceIPAddress": "Amazon Internal", "userAgent": "Amazon Internal", "requestParameters": null, "responseElements": null, "eventID": "b25f9cda-74e1-4458-847b-4972a0bf9668", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ], "eventType": "AwsServiceEvent", "recipientAccountId": "111122223333", "managementEvent": true, "eventCategory": "Management" }
The following CloudTrail log entry records a DeleteKey
operation of a KMS key in
an Amazon CloudHSM custom key store.
{ "eventVersion": "1.08", "userIdentity": { "accountId": "111122223333", "invokedBy": "Amazon Internal" }, "eventTime": "2021-10-26T23:41:27Z", "eventSource": "kms.amazonaws.com", "eventName": "DeleteKey", "awsRegion": "us-east-1", "sourceIPAddress": "Amazon Internal", "userAgent": "Amazon Internal", "requestParameters": null, "responseElements": { "keyId":"arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" }, "additionalEventData": { "customKeyStoreId": "cks-1234567890abcdef0", "clusterId": "cluster-1a23b4cdefg", "backingKeys": "[{\"keyHandle\":\"01\",\"backingKeyId\":\"
backing-key-id
\"}]", "backingKeysDeletionStatus": "[{\"keyHandle\":\"01\",\"backingKeyId\":\"backing-key-id
\",\"deletionStatus\":\"SUCCESS\"}]" }, "eventID": "1234585c-4b0c-4340-ab11-662414b79239", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ], "eventType": "AwsServiceEvent", "recipientAccountId": "111122223333", "managementEvent": true, "eventCategory": "Management" }