Very high KMS usage in a region in which nothing is running

0

Billing dashboard shows:

Enter image description here

Account has no customer-managed keys in this region, only one AWS-managed key for aws/ebs (Elastic Block Store, not Beanstalk). There are no EBS volumes in this region, nor snapshots, nor running EC2/Lightsail/RDS/anything else instances that could be using EBS.

At the exact date & time the AWS-managed key was created, CloudTrail shows events happening in AWS Application Migration Service. And yes, I was poking around that service that day, to get a feel for what it's like to use and how it all fits together, and yes I did all this in the region in question so that I could keep it all separate from things running elsewhere in other regions. But never did a migration, never even got close setting things up to do a migration.

Setup CloudTrail logging and there are regularly entries like:

{"sessionIssuer":{"type":"Role","principalId":"[principal_id]","arn":"arn:aws:iam::[acct_num]:role/aws-service-role/mgn.amazonaws.com/AWSServiceRoleForApplicationMigrationService","accountId":"[acct_num]","userName":"AWSServiceRoleForApplicationMigrationService"},"webIdFederationData":{},"attributes":{"creationDate":"2023-08-20T23:51:07Z","mfaAuthenticated":"false"}},"invokedBy":"mgn.amazonaws.com"},"eventTime":"2023-08-20T23:51:08Z","eventSource":"ec2.amazonaws.com","eventName":"GetEbsDefaultKmsKeyId"

So it's definitely Migration Service calling KMS to get the key for an EBS volume. About 4500 times per month (pro rata) it would appear. I know I get 20000 KMS requests per month for free so this isn't costing me anything, but I'd still like it to stop.

The service role in that extract (and six others) were created in IAM at the same time as the KMS key was, which was the same time as initialising Application Migration Service. So it all fits together from that point of view.

Question (after all that): is there a way of stopping this Migration Service which is doing nothing of value? it was setup in AWS Console but there is no option to stop it, though there is an API command, which I may end up having to use, but I thought would post here first and get some better suggestions. The KMS key can't be deleted, and while the IAM roles could be modified or deleted that doesn't really solve the underlying problem.

Also interesting to note that Application Migration Service isn't a line item in the Billing Dashboard.

No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions