AWS SDK Version 3 for .NET
API Reference

AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.

Schedules the deletion of a customer master key (CMK). You may provide a waiting period, specified in days, before deletion occurs. If you do not provide a waiting period, the default period of 30 days is used. When this operation is successful, the key state of the CMK changes to PendingDeletion. Before the waiting period ends, you can use CancelKeyDeletion to cancel the deletion of the CMK. After the waiting period ends, AWS KMS deletes the CMK and all AWS KMS data associated with it, including all aliases that refer to it.

Deleting a CMK is a destructive and potentially dangerous operation. When a CMK is deleted, all data that was encrypted under the CMK is unrecoverable. To prevent the use of a CMK without deleting it, use DisableKey.

If you schedule deletion of a CMK from a custom key store, when the waiting period expires, ScheduleKeyDeletion deletes the CMK from AWS KMS. Then AWS KMS makes a best effort to delete the key material from the associated AWS CloudHSM cluster. However, you might need to manually delete the orphaned key material from the cluster and its backups.

You cannot perform this operation on a CMK in a different AWS account.

For more information about scheduling a CMK for deletion, see Deleting Customer Master Keys in the AWS Key Management Service Developer Guide.

The CMK that you use for this operation must be in a compatible key state. For details, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide.


For .NET Core and PCL this operation is only available in asynchronous form. Please refer to ScheduleKeyDeletionAsync.

Namespace: Amazon.KeyManagementService
Assembly: AWSSDK.KeyManagementService.dll
Version: 3.x.y.z


public virtual ScheduleKeyDeletionResponse ScheduleKeyDeletion(
         ScheduleKeyDeletionRequest request
Type: Amazon.KeyManagementService.Model.ScheduleKeyDeletionRequest

Container for the necessary parameters to execute the ScheduleKeyDeletion service method.

Return Value
The response from the ScheduleKeyDeletion service method, as returned by KeyManagementService.


DependencyTimeoutException The system timed out while trying to fulfill the request. The request can be retried.
InvalidArnException The request was rejected because a specified ARN, or an ARN in a key policy, is not valid.
KMSInternalException The request was rejected because an internal exception occurred. The request can be retried.
KMSInvalidStateException The request was rejected because the state of the specified resource is not valid for this request. For more information about how key state affects the use of a CMK, see How Key State Affects Use of a Customer Master Key in the AWS Key Management Service Developer Guide.
NotFoundException The request was rejected because the specified entity or resource could not be found.


The following example schedules the specified CMK for deletion.

To schedule a customer master key (CMK) for deletion

var response = client.ScheduleKeyDeletion(new ScheduleKeyDeletionRequest 
    KeyId = "1234abcd-12ab-34cd-56ef-1234567890ab", // The identifier of the CMK to schedule for deletion. You can use the key ID or the Amazon Resource Name (ARN) of the CMK.
    PendingWindowInDays = 7 // The waiting period, specified in number of days. After the waiting period ends, AWS KMS deletes the CMK.

DateTime deletionDate = response.DeletionDate; // The date and time after which AWS KMS deletes the CMK.
string keyId = response.KeyId; // The ARN of the CMK that is scheduled for deletion.


Version Information

.NET Framework:
Supported in: 4.5, 4.0, 3.5

Portable Class Library:
Supported in: Windows Store Apps
Supported in: Windows Phone 8.1
Supported in: Xamarin Android
Supported in: Xamarin iOS (Unified)
Supported in: Xamarin.Forms

See Also