Question

A security engineer accidentally scheduled deletion of a customer managed KMS key that is used to encrypt production RDS snapshots and several S3 objects. The deletion was scheduled with the default waiting period. The team realizes the mistake two days later and is worried about permanently losing the ability to decrypt data. What is the correct action to prevent data loss?

Accepted Answer

Cancel the scheduled key deletion, which returns the key to the Disabled state, then re-enable the key so it can be used for decryption again.

Answer

Create a new KMS key with the same key material and update the RDS and S3 configurations to reference it before the deletion completes.

Answer

Immediately export the existing key material from KMS and re-import it into a new key to preserve decryption capability.

Answer

Contact AWS Support to halt the deletion because scheduled key deletions cannot be canceled by customers once initiated.