ScheduleKeyDeletion - Amazon Key Management Service
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

ScheduleKeyDeletion

These examples show Amazon CloudTrail log entries for the ScheduleKeyDeletion operation.

For an example of the CloudTrail log entry that is written when the key is deleted, see DeleteKey. For information about deleting Amazon KMS keys, see Deleting Amazon KMS keys.

The following example records a ScheduleKeyDeletion request for a single-Region KMS key.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2021-03-23T18:58:30Z", "eventSource": "kms.amazonaws.com", "eventName": "ScheduleKeyDeletion", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Amazon Internal", "requestParameters": { "pendingWindowInDays": 20, "keyId": "1234abcd-12ab-34cd-56ef-1234567890ab" }, "responseElements": { "keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", "keyState": "PendingDeletion", "deletionDate": "Apr 12, 2021 18:58:30 PM" }, "requestID": "ee408f36-ea01-422b-ac14-b0f147c68334", "eventID": "3c4226b0-1e81-48a8-a333-7fa5f3cbd118", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ], "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }

The following example records a ScheduleKeyDeletion request for a multi-Region KMS key with replica keys.

Because Amazon KMS won't delete a multi-Region key until all of its replica keys are deleted, in the responseElements field, the keyState is PendingReplicaDeletion and the deletionDate field is omitted.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2021-10-28T17:59:05Z", "eventSource": "kms.amazonaws.com", "eventName": "ScheduleKeyDeletion", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.0", "userAgent": "Amazon Internal", "requestParameters": { "pendingWindowInDays": 30, "keyId": "mrk-1234abcd12ab34cd56ef1234567890ab" }, "responseElements": { "keyId": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab", "keyState": "PendingReplicaDeletion", "pendingWindowInDays": 30 }, "requestID": "12341411-d846-42a6-a476-b1cbe3011f89", "eventID": "abcda5f-396d-494c-9380-0c47860df5f1", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/mrk-1234abcd12ab34cd56ef1234567890ab" } ], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management" }

The following example records a ScheduleKeyDeletion request for a KMS key in an Amazon CloudHSM custom key store.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2021-10-26T23:25:25Z", "eventSource": "kms.amazonaws.com", "eventName": "ScheduleKeyDeletion", "awsRegion": "us-west-2", "sourceIPAddress": "192.0.2.0", "userAgent": "Amazon Internal", "requestParameters": { "keyId": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", "pendingWindowInDays": 30 }, "responseElements": { "keyId": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321", "deletionDate": "Nov 2, 2021, 11:25:25 PM", "keyState": "PendingDeletion", "pendingWindowInDays": 30 }, "additionalEventData": { "customKeyStoreId": "cks-1234567890abcdef0", "clusterId": "cluster-1a23b4cdefg", "backingKeys": "[{\"keyHandle\":\"01\",\"backingKeyId\":\"backing-key-id\"}]" }, "requestID": "abcd9f60-2c9c-4a0b-a456-d5d998f7f321", "eventID": "ca01996a-01b0-4edd-bbbb-25d7b6d1a6fa", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/0987dcba-09fe-87dc-65ba-ab0987654321" } ], "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management" }