Aws-Kms - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/aws-kms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 24 Aug 2026 09:49:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAWS KMS Customer Managed Key Lifecycle Manipulationhttps://feed.craftedsignal.io/briefs/2026-08-aws-kms-lifecycle-manipulation/Mon, 24 Aug 2026 09:49:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-aws-kms-lifecycle-manipulation/Adversaries may disable or schedule the deletion of AWS KMS keys to sabotage business operations, render encrypted data unrecoverable, and obstruct forensic investigation or incident response efforts.Adversaries targeting AWS environments may attempt to disable or schedule the deletion of Customer Managed KMS keys to disrupt service availability and cause permanent data loss. Because KMS keys underpin the encryption for critical services such as S3, EBS, RDS, Secrets Manager, and Lambda, controlling these keys provides an attacker with a high-impact lever to sabotage an organization. This activity is typically observed in later stages of an intrusion, where an attacker seeks to hide evidence of prior exfiltration, prevent recovery from ransomware, or impede incident response by destroying access to encrypted forensic data and backups. Defenders should monitor for highly privileged KMS lifecycle API calls that deviate from established infrastructure-as-code deployment patterns.

Attack Chain

  1. Attacker gains initial access to the AWS environment through compromised IAM credentials or over-privileged service roles.
  2. Attacker performs internal reconnaissance to identify critical KMS keys and the AWS services they protect (e.g., S3 buckets, RDS instances).
  3. Attacker uses compromised credentials to execute the DisableKey API call via AWS CLI or SDK to immediately halt encryption/decryption operations for targeted services.
  4. Attacker monitors service health or application logs to confirm the disruption of operations.
  5. Attacker executes the ScheduleKeyDeletion API call, initiating a mandatory waiting period before the key and its associated material are permanently destroyed.
  6. Attacker leverages the resulting downtime or recovery chaos to exfiltrate remaining data or obfuscate their activities.
  7. Attacker objective achieved: permanent data loss and environmental sabotage.

Impact

Successful manipulation of KMS lifecycle states results in immediate loss of access to encrypted data stored in S3, EBS volumes, or RDS databases. Once the pending deletion window expires, this data becomes permanently unrecoverable, causing severe business disruption, potential regulatory compliance failures, and the total loss of forensic evidence required for incident response.

Recommendation

  • Deploy the provided detection rule to monitor for DisableKey and ScheduleKeyDeletion events in AWS CloudTrail logs.
  • Restrict the kms:DisableKey and kms:ScheduleKeyDeletion permissions to a minimal set of highly privileged administrator identities using IAM policies or Service Control Policies (SCPs).
  • Enable AWS Config rules to monitor and alert on the state of KMS keys.
  • Require multi-factor authentication (MFA) for all IAM principals authorized to perform KMS management operations.
  • Implement tagging and naming conventions to distinguish between critical production KMS keys and ephemeral keys used in CI/CD pipelines to reduce false positives in detections.
]]>mediumadvisoryimpactcloud-securityaws-kmsincident-response