How to Prevent Accidental KMS Key Deletion

Quick Answer

KMS keys are not deleted directly; they go through a mandatory waiting period initiated by the kms:ScheduleKeyDeletion action, so the lever for preventing accidental deletion is controlling who is allowed to call that specific action, rather than looking for some separate deletion-protection toggle. An IAM policy, whether attached directly to the key as a key policy or to the users and roles that would otherwise have permission, can explicitly deny kms:ScheduleKeyDeletion, blocking the deletion process from ever being initiated regardless of what other permissions a principal holds. This is a useful pattern to recognize generally: AWS security questions often ask you to find the specific API action that gates a dangerous or irreversible operation, and the correct control is almost always a deny targeting that exact action rather than a broader setting. It also helps to know what the near-miss options do: automatic key rotation only changes the underlying cryptographic material on a schedule and has nothing to do with deletion, and KMS does not expose a simple deletion-protection switch the way some other resources do; protection comes purely through policy-based denial. Whenever a question asks how to prevent an irreversible action on an AWS resource, look first for the specific API call that initiates it, since the answer is usually a deny statement targeting that exact permission rather than a feature toggle.