Question

A SysOps administrator accidentally scheduled deletion of a customer managed AWS KMS key that is still used to encrypt an active Amazon EBS volume and several S3 objects. The key was scheduled for deletion with the default waiting period. The administrator realizes the mistake two days later and needs to prevent data loss. What is the correct action?

Accepted Answer

Cancel the key deletion using the CancelKeyDeletion action, then re-enable the key with the EnableKey action.

Answer

Create a new KMS key and update the EBS volume and S3 objects to use the new key before the deletion completes.

Answer

Restore the key from an AWS Backup vault since KMS keys are automatically backed up.

Answer

Import new key material into the scheduled key to override the deletion timer.