Elastic Security Detection Rules

AWS KMS Imported Key Material Deleted

Last updated 2 months ago on 2026-06-18
Created 2 months ago on 2026-06-18

About

Identifies deletion of imported key material from an AWS KMS customer managed key via DeleteImportedKeyMaterial. Keys created with an external key material origin (BYOK) rely on key material that the customer imports. Deleting that material immediately makes the key unusable and renders all data encrypted under it inaccessible, with no recovery window. Unlike ScheduleKeyDeletion, which enforces a pending deletion period of 7 to 30 days, this action takes effect instantly, making it an attractive primitive for cloud ransomware and data-destruction attacks. Because this operation only applies to external-origin keys and is rare in normal operations, its use by an unexpected principal warrants prompt review.
Tags
Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS KMSUse Case: Threat DetectionTactic: ImpactLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Data Destruction (T1485)(external, opens in a new tab or window)

False Positive Examples
Encryption or platform teams that operate keys with imported key material (BYOK/HYOK) may delete and re-import material during key rotation, migration, or decommissioning. Verify the principal in "aws.cloudtrail.user_identity.arn", confirm the change aligns with a planned key lifecycle activity, and check whether material was re-imported shortly after. Known administration roles and automation can be excluded after validation.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.cloudtrail-*
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "kms.amazonaws.com"
    and event.action: "DeleteImportedKeyMaterial"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"

Install detection rules in Elastic Security

Detect AWS KMS Imported Key Material Deleted in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).