Detecting and Notifying on AWS KMS CMK Deletion Events

Setting up email notifications to be triggered when customer managed keys are disabled or scheduled for deletion

Photo by Jaye Haych on Unsplash

Introduction

AWS Key Management Service (KMS) is a service offered by AWS to generate and manage the cryptographic keys utilised to protect your data.

AWS KMS keys are the primary resource in AWS KMS and are used to encrypt, decrypt and re-encrypt data. An AWS KMS key is a logical representation of a cryptographic key.

A KMS key created by the user is a customer managed key (CMK). CMKs are commonly used to safeguard highly sensitive data. Unlike AWS managed keys or AWS owned keys, CMKs allow the user to both view KMS key metadata and manage the KMS key.

Since CMKs are employed for encryption and decryption of data in the AWS account, disabling or deletion of a CMK would pose a security risk. An email notification could be triggered whenever a CMK is disabled or is scheduled for deletion, the process of which will be explained in this article.

Architecture diagram

Implementation

As can be seen in the architecture diagram, the following AWS services were used:

• IAM
• SNS
• CloudWatch
• CloudTrail

Part 1: IAM

Create an IAM role that can be assumed by CloudTrail.

The following steps are taken in the IAM Management Console:

1. Choose Roles from the sidebar.
2. Choose Create role.
3. For Trusted entity type, choose AWS service.
4. For Use case, from the dropdown list under Use cases for other AWS services, choose CloudTrail.
5. Choose Next.
6. Choose Next.
7. Choose Create role.
8. Take note of the role name.

Part 2: SNS

Create and subscribe to an SNS topic

The following steps are taken in the SNS console:

1. On the SNS dashboard, select Topics, and then choose Create Topic.
2. Choose Standard.
3. Enter a name for the topic (eg. cmk-notif-topic).
4. Choose Create Topic.
5. Note the topic’s ARN (eg. arn:aws:sns:eu-west-2:123123123123:cmk-notif-topic).
6. On the SNS dashboard, select Subscriptions, and then choose Create subscription.
7. For Topic ARN, enter the ARN from Step 5.
8. For Protocol, choose Email.
9. For Endpoint, enter an email address to receive the notifications.
10. Choose Create subscription.

An email to confirm the subscription will be sent to the email address specified in Step 9. After you confirm the subscription, the email address receives notifications when the SNS topic is triggered.

Part 3: CloudWatch

Part 3.1: Create a CloudWatch metric filter

The following steps are taken in the CloudWatch console:

1. On the dashboard, choose Logs, then select Log groups.
2. Choose Create log group.
3. Enter a name for the log group (eg. cmk-logs).
4. Choose Create.
5. Take note of the log group name.
6. On the list of Log groups, choose the log group created in Step 4.
7. Choose Actions, then select Create metric filter.
8. For Filter pattern, use the following value: { ($.eventSource = kms.amazonaws.com) && (($.eventName = “DisableKey”) || ($.eventName = “ScheduleKeyDeletion”)) }
9. Choose Next.
10. Enter a name for the filter (eg. cmk-disable-delete-filter).
11. For Metric namespace, ensure the slider is on Create new, and enter your metric namespace (eg. cmk-metrics).
12. Enter a name for the metric (eg. cmk-disable-delete-metric).
13. Take note of the metric name.
14. For Metric value, enter 1.
15. Choose Next.
16. Choose Create metric filter.

Example CloudWatch metric filter

Part 3.2: Create a CloudWatch alarm

The following steps should be taken in the CloudWatch console:

1. On the dashboard, choose Logs, then select Log groups.
2. Choose the log group created in Part 3.1 Step 4.
3. Choose Metric filters.
4. In the metric filters tab, choose the box for the metric filter that you want to base your alarm on.
5. Choose Create alarm.
6. For Threshold type, choose Static.
7. For Whenever <metric name> is …, choose Greater/Equal.
8. For than …, enter 1.
9. Choose Additional configuration.
10. For Data points to alarm, choose 1 out of 1.
11. For Missing data treatment, choose Treat missing data as good (not breaching threshold).
12. Choose Next.
13. For Send a notification to…, choose the SNS topic created in Part 2.
14. Choose Next.
15. Enter a name for the alarm (eg. cmk-disable-delete-alarm).
16. Choose Next.
17. Choose Create alarm.

Do note that the filter pattern can be edited to specify a particular KMS key, with the filter pattern being shown below:

{ ($.eventSource = kms.amazonaws.com) && ($.resources[0].ARN = "<key ARN>") && (($.eventName = "DisableKey") || ($.eventName = "ScheduleKeyDeletion")) }

Example CloudWatch alarm

Part 4: CloudTrail

Create a CloudTrail trail that logs API calls from EC2

The following steps are taken in the CloudTrail console:

1. Select Create trail.
2. Enter a name for the Trail name (eg. cmk-notif-trail).
3. For Storage location, you can choose either Create new S3 bucket or Use existing S3 bucket.
4. For CloudWatch Logs, choose Enabled.
5. For Log group, choose Existing.
6. For Log group name, copy-paste the log group name from Part 3.1 Step 5.
7. For IAM Role, choose Existing.
8. For Role name, copy-paste the IAM role name from Part 1 Step 8.
9. Leave the remaining settings as default and choose Next.
10. For Event type, choose Management events.
11. Leave the remaining settings as default and choose Next.
12. Choose Create trail.

Upon implementation. the relevant individuals will receive a notification each time the CloudWatch alarm enters the ALARM state. If a notification is received for this alarm, it means that a KMS key is scheduled for deletion or disabled.

Conclusion

This article presents a suggested architecture that would help you to set up email notifications triggered by KMS CMK deletion or disabling events. This architecture uses the following AWS services: CloudTrail, CloudWatch, IAM, and SNS.

It is easy to get started using the AWS Management Console, however, there are other improved ways to implement this solution, such as using Terraform, Cloudformation or AWS CLI.

Hope this was a helpful start! Please leave a clap if you liked this article, thank you.

You can get full access to every story on Medium for just $5/month by signing up through this link.

More content at **PlainEnglish.io**.

Sign up for our **free weekly newsletter. Follow us on [Twitter](https://twitter.com/inPlainEngHQ)**, ***LinkedIn, YouTube, and [Discord](https://discord.com/invite/GtDtUAvyhW).***

Build awareness and adoption for your tech startup with Circuit.