# 4.7 Ensure Disabling or Scheduled Deletion of Customer Created CMKs is Monitored (Manual) - Source: https://support.icompaas.com/support/solutions/articles/62000233139-4-7-ensure-disabling-or-scheduled-deletion-of-customer-created-cmks-is-monitored-manual- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 4](https://support.icompaas.com/support/solutions/folders/62000169196) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Profile Applicability:** **Level 2** ## **Description:** AWS CloudTrail enables real-time monitoring of API calls by logging events to CloudWatch Logs or an external SIEM. This control ensures that customer-managed KMS keys (CMKs) that are disabled or scheduled for deletion are monitored to prevent accidental data loss or security risks. Key Management Service (KMS) Customer-Managed Keys (CMKs) - CMKs are cryptographic keys created and controlled by the user. - If a CMK is disabled or deleted, data encrypted using the key becomes inaccessible. Monitoring DisableKey and ScheduleKeyDeletion API calls helps ensure that keys are not accidentally or maliciously disabled/deleted. Rationale: Monitoring CMK state changes helps prevent: - Accidental key disablement or deletion leading to loss of access to encrypted data. - Malicious attempts to disable encryption keys and compromise data security. - Regulatory non-compliance, as key management is critical for compliance with SOC 2, HIPAA, PCI DSS, and GDPR. ## Impact: - If a key is disabled or deleted, encrypted data becomes inaccessible. - Monitoring these events ensures immediate alerts to prevent business disruptions. - AWS KMS costs may apply for storing and managing CMKs. Default Value: - AWS does not monitor CMK state changes by default. - CloudTrail logs these changes, but CloudWatch Alarms and SNS notifications must be configured manually. ## Pre-Requisites: 1. AWS CloudTrail enabled with multi-region logging. 2. AWS CloudWatch Logs enabled and linked to CloudTrail. 3. IAM Permissions Required: - cloudtrail:DescribeTrails - cloudtrail:GetEventSelectors - logs:DescribeMetricFilters - cloudwatch:DescribeAlarms - sns:ListSubscriptionsByTopic - logs:PutMetricFilter, cloudwatch:PutMetricAlarm, sns:CreateTopic ## Remediation: ### Test Plan: ## Using AWS Console 1. Login to the AWS Management Console. 2. Navigate to CloudTrail: [AWS CloudTrail Console](https://console.aws.amazon.com/cloudtrail/home). ![](https://support.icompaas.com/assets/kb/7ca0c6601eb61e4b.png) 3. Verify there is at least one multi-region CloudTrail trail enabled. 4. Ensure CloudTrail is logging management events: - Click on the trail and check Event Selectors. ![](https://support.icompaas.com/assets/kb/6e16fff891f1bb4f.png) - Ensure management events are set to "All". ![](https://support.icompaas.com/assets/kb/acf4d1d2f5495db8.png) 5. Check that CloudTrail logs are being sent to CloudWatch. 6. Navigate to CloudWatch Logs: [AWS CloudWatch Console](https://console.aws.amazon.com/cloudwatch/home). ![](https://support.icompaas.com/assets/kb/c0b50d0ba985a808.png) 7. Ensure that a metric filter is created for CMK disablement or deletion. 8. Check CloudWatch Alarms for alerts on CMK state changes. ![](https://support.icompaas.com/assets/kb/d4b1d955c3944b38.png) Implementation Steps: Using AWS CLI ### Step 1: Create a Metric Filter for CMK Disablement or Deletion aws logs put-metric-filter --log-group-name \\ --filter-name disable-or-delete-cmk-changes-metric \\ --metric-transformations metricName=disable-or-delete-cmk-changes-metric,metricNamespace="CISBenchmark",metricValue=1 \\ --filter-pattern '{ ($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion)) }' Step 2: Create an SNS Topic for Notifications aws sns create-topic --name disable-or-delete-cmk-changes-alerts Step 3: Subscribe to SNS Topic aws sns subscribe --topic-arn --protocol email --notification-endpoint Step 4: Create a CloudWatch Alarm for CMK Disablement or Deletion aws cloudwatch put-metric-alarm --alarm-name disable-or-delete-cmk-changes-alarm \\ --metric-name disable-or-delete-cmk-changes-metric --statistic Sum --period 300 \\ --threshold 1 --comparison-operator GreaterThanOrEqualToThreshold \\ --evaluation-periods 1 --namespace "CISBenchmark" --alarm-actions Backout Plan: 1. Delete CloudWatch Alarm: aws cloudwatch delete-alarms --alarm-names disable-or-delete-cmk-changes-alarm 2. Remove the metric filter: aws logs delete-metric-filter --log-group-name --filter-name disable-or-delete-cmk-changes-metric 3. Delete SNS topic: aws sns delete-topic --topic-arn ## References: - [AWS CloudTrail Monitoring with CloudWatch](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) - [AWS KMS Key State Management](https://docs.aws.amazon.com/kms/latest/developerguide/key-state.html) ## CIS Controls Mapping:

CIS Control Version

Control ID

Control Description

CIS v8

8.5

Collect detailed audit logs for security monitoring.

CIS v8

8.11

Conduct audit log reviews to detect anomalies.

CIS v7

6.3

Enable detailed logging for security monitoring.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.