Question

A security engineer creates a customer managed KMS key using the AWS CLI and specifies a custom key policy. The policy grants encrypt/decrypt permissions to a specific application IAM role but does NOT include any statement granting the account root principal access, and it does not enable IAM policies to control the key. Several weeks later, the application role is accidentally deleted during a cleanup, and no other principal can manage or use the key. What is the state of the key and the recommended prevention?

Accepted Answer

The key is unmanageable and effectively unrecoverable through normal means; contact AWS Support. To prevent this, key policies should always include a statement giving the account root principal full kms:* access so IAM administration remains possible.

Answer

The key automatically falls back to the AWS managed key policy, so any IAM administrator can immediately regain access; no prevention is needed.

Answer

Enabling automatic key rotation on the key would have restored access because rotation regenerates the key policy with default permissions.

Answer

The key can be recovered by any principal with the AdministratorAccess managed policy, because IAM administrator permissions always override KMS key policies.