English
Español
Français
Deutsch
日本語
한국어
العربيةSchedule KMS key deletion
Can schedule a KMS key for deletion, destroying everything it encrypts.
Grants escalation on its own.
kms:ScheduleKeyDeletionOn its own, kms:ScheduleKeyDeletion can schedule a KMS key for deletion, destroying everything it encrypts. On a wide resource scope that alone reaches access for an outside or public principal.
Why it is dangerous
A principal can call kms:ScheduleKeyDeletion on customer-managed the key. Once the waiting period elapses the key material is destroyed and every object, snapshot, secret and parameter encrypted under it becomes permanently unreadable - a one-call, account-wide data-destruction move that no backup of the ciphertext can undo. Deleting the key also blinds anything that depended on decrypting with it.
In MITRE ATT&CK terms this maps to T1485, Data Destruction, under the impact tactic. AWS records it in CloudTrail as ScheduleKeyDeletion. The call is loud in CloudTrail and stands out from normal activity.
Detection
ScheduleKeyDeletionPrerequisites
kms:ScheduleKeyDeletion on the key, allowed by both the identity policy and the key policy. A 7-30 day waiting period applies before the key material is destroyed.
MITRE ATT&CK
T1485 · Data DestructionTactic
Impact
A control that would remove it: Restrict kms:ScheduleKeyDeletion to key administrators; deny it via SCP outside a break-glass role.
Whether to apply it depends on how the permission is used in your environment, so it is a business decision rather than an automatic fix. The same permission can be load-bearing in one account and pure risk in another.
Pathbreak confirms whether this path resolves in your account, ranks it against the others by how much it opens up, and uses your threat model and business context to show which paths are worth cutting.
Questions
What does kms:ScheduleKeyDeletion allow?
Can schedule a KMS key for deletion, destroying everything it encrypts.
Can kms:ScheduleKeyDeletion escalate privileges on its own?
Yes. Held on a broad enough resource it reaches access for an outside or public principal with no other permission.
How is schedule KMS key deletion detected?
Watch for ScheduleKeyDeletion in CloudTrail. The call is loud in CloudTrail and stands out from normal activity.
How do you break this path?
A control that would remove it is: Restrict kms:ScheduleKeyDeletion to key administrators; deny it via SCP outside a break-glass role. Whether to apply it depends on how the permission is used in your account, so it is a business decision rather than an automatic fix.
Which MITRE ATT&CK technique is this?
T1485, Data Destruction, under the impact tactic.
Related paths
References
Find this in your own account
We run a read-only scan of one AWS account and show you which of these paths exist, ranked by blast radius, with the change that breaks each one. First validated paths within the hour.