LoFP / encryption or platform teams that operate keys with imported key material (byok/hyok) may delete and re-import material during key rotation, migration, or decommissioning. verify the principal in \"aws.cloudtrail.user_identity.arn\", confirm the change aligns with a planned key lifecycle activity, and check whether material was re-imported shortly after. known administration roles and automation can be excluded after validation.

Techniques

• T1485

Sample rules

AWS KMS Imported Key Material Deleted

• source: elastic
• technicques:
  • T1485

Description

Identifies deletion of imported key material from an AWS KMS customer managed key via DeleteImportedKeyMaterial. Keys created with an external key material origin (BYOK) rely on key material that the customer imports. Deleting that material immediately makes the key unusable and renders all data encrypted under it inaccessible, with no recovery window. Unlike ScheduleKeyDeletion, which enforces a pending deletion period of 7 to 30 days, this action takes effect instantly, making it an attractive primitive for cloud ransomware and data-destruction attacks. Because this operation only applies to external-origin keys and is rare in normal operations, its use by an unexpected principal warrants prompt review.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "kms.amazonaws.com"
    and event.action: "DeleteImportedKeyMaterial"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"