Deleting One or More CMKs

Prerequisites

• The key to be deleted is in Enabled, Disabled, or Pending import status.

Constraints

• A key will not be deleted until its scheduled deletion period expires. You can set the period to a value within the range 7 to 1096 days.

  Before the specified deletion date, you can cancel the deletion if you want to use the CMK. Once the scheduled deletion has taken effect, the CMK will be deleted permanently and you will not be able to decrypt data encrypted by the CMK. Exercise caution when performing this operation.

• Default keys created by KMS cannot be scheduled for deletion.

Procedure

1. Log in to the management console.
2. Click . Choose Security > Key Management Service. The Key Management Service page is displayed.
3. In the row containing the target CMK, click Delete in the Operation column.
4. On the key deletion dialog box, enter the deletion delay time.
   

   • A key will not be deleted until its scheduled deletion period expires. You can set the period to a value within the range 7 to 1096 days. Before the specified deletion date, you can cancel the deletion if you want to use the CMK.

To schedule the deletion of multiple CMKs at a time, select them and click Delete in the upper left corner of the list.