Question

A security team discovers that a developer accidentally scheduled deletion of a customer-managed KMS key that encrypts several production RDS databases and S3 buckets. The organization wants an automated safeguard so that any future ScheduleKeyDeletion API call for keys tagged 'Protected=true' is immediately reversed and the on-call team is alerted, without manual intervention. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create an EventBridge rule matching the CloudTrail 'ScheduleKeyDeletion' event, filter on the resource ARN, and trigger a Lambda function that calls CancelKeyDeletion and publishes to an SNS topic; verify the key's 'Protected' tag inside the function before acting.

Answer

Enable an AWS Config managed rule to detect KMS keys pending deletion and configure an SSM Automation remediation that re-enables the key on a 24-hour evaluation cycle, notifying via SNS.

Answer

Create a CloudWatch alarm on the KMS 'KeyDeletionScheduled' metric and attach an SNS action that emails the on-call team so they can manually cancel the deletion.

Answer

Attach an SCP that denies the kms:ScheduleKeyDeletion action for all principals in the organization, preventing any key deletion scheduling entirely.