No CloudWatch alarm for KMS CMK disable or scheduled deletion

Severity: High
Service: Monitoring and alarms
Check ID: CLOUDWATCH_ALARM_CMK_DELETION

What this check finds

No metric filter and alarm detect KMS customer-managed key disable or scheduled deletion events. These events permanently impact data availability and encryption guarantees. CIS v1.4 §4.7.

Passing looks like: CloudWatch alarm for KMS CMK deletion configured.

How to fix it

Create a metric filter with pattern: {($.eventSource = "kms.amazonaws.com") && (($.eventName = "DisableKey") || ($.eventName = "ScheduleKeyDeletion"))} and a CloudWatch alarm.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to No CloudWatch alarm for KMS CMK disable or scheduled deletion
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	4.7 Ensure disabling or scheduled deletion of customer created CMKs is monitored
NIST SP 800-53 Rev5 (Moderate)	AU-6 Audit Record Review, Analysis, and Reporting SC-12 Cryptographic Key Establishment and Management SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected DE.AE-02 Adverse events are analyzed DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Monitoring and alarms checks

All Monitoring and alarms checks