ScheduleKeyDeletion - AWS Key Management Service


The following example shows an AWS CloudTrail log entry generated by calling the ScheduleKeyDeletion operation on a single-Region KMS key.

In the log entry for ScheduleKeyDeletion on a multi-Region primary key with replicas, the keyState is PendingReplicaDeletion and the deletionDate field is omitted.

For an example of the CloudTrail log entry that is written when the key is deleted, see DeleteKey. For information about deleting AWS KMS keys, see Deleting AWS KMS keys.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111122223333:user/Alice", "accountId": "111122223333", "accessKeyId": "EXAMPLE_KEY_ID", "userName": "Alice" }, "eventTime": "2021-03-23T18:58:30Z", "eventSource": "", "eventName": "ScheduleKeyDeletion", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "AWS Internal", "requestParameters": { "pendingWindowInDays": 20, "keyId": "1234abcd-12ab-34cd-56ef-1234567890ab" }, "responseElements": { "keyId": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab", "keyState": "PendingDeletion", "deletionDate": "Apr 12, 2021 18:58:30 PM" }, "requestID": "ee408f36-ea01-422b-ac14-b0f147c68334", "eventID": "3c4226b0-1e81-48a8-a333-7fa5f3cbd118", "readOnly": false, "resources": [ { "accountId": "111122223333", "type": "AWS::KMS::Key", "ARN": "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" } ], "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }