AWS Unused KMS Key

Risk Level: Low

Description

This plugin checks for any disabled KMS Customer Master Keys in your AWS account. Disabled KMS keys will add unnecessary charges to your AWS account without performing any encryption for the services.

About the Service

AWS Key Management Service (KMS): AWS KMS is a storehouse of cryptographic keys that can be easily utilized by your AWS resources and applications. Encryption with KMS keys ensures that your resources and applications are secured with centralized management. Logs can also be generated to audit key usage across various services. All the keys are properly secured by AWS KMS.

Impact

Unnecessary KMS keys can add to Bill for your account. It is advisable to remove such keys to avoid charges. Disabled keys do not perform any encryption.

Steps to Reproduce

Using AWS Console-

1. Log In to your AWS Console.
2. Open the AWS KMS Console. You can use this link (https://console.aws.amazon.com/kms/) to navigate directly if already logged in. 
3. From the left navigation pane, click on Customer-managed keys.
   
4. A list of CMK keys in the region will be displayed. 
5. Check the Status column. If it is set to “Disabled”, the vulnerability exists. 
6. Repeat steps for all the keys you wish to examine.

Steps for Remediation

Delete unused AWS KMS Keys.

1. Log In to your AWS Console.
2. Open the AWS KMS Console. You can use this link (https://console.aws.amazon.com/kms/) to navigate directly if already logged in. 
3. From the left navigation pane, click on Customer-managed keys.
   
4. A list of CMK keys in the region will be displayed. Select the vulnerable key by clicking on it’s Key ID.
5. From the Actions menu, select “Schedule Key Deletion”. Specify the number of days after which you want the key to be deleted.
6. Repeat steps for all the vulnerable keys.