跳至內容

Destroy and Recreate KMS key in Cloudformation?

0

If I have a KMS key created in a cloudformation and I have used that KMS key for encryption on a few things but wanted to make a new cloudformation, is it possible to destroy that original cloudformation and make a new cloudformation that generates the same KMS key that was destroyed? Will the new key still work on my encrypted items?

2 個答案
1
已接受的答案

Not exactly. If you do what you describe, your current KMS key will be scheduled for deletion, immediately stopping all cryptographic operations on it and, if you don't cancel the deletion, the key and everything encrypted with it will be lost forever.

However, what you can do is update your CloudFormation template such that you add the DeletionPolicy: Retain attribute on the current KMS key resource (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html). Update your stack with the revised template, and make sure no unintended changes get included in the update.

Once this is done, you can delete the current CloudFormation stack. It will leave the KMS key in place, due to the DeletionPolicy property having the "Retain" value. At this point, the KMS key will no longer be managed by CloudFormation.

You can then create a new stack with the CFN template that you'd like, but using the "Import existing resources" stack creation option. There are certain limitations to how the existing resource, KMS key in this case, has to be declared in the template during an import operation. For example, every resource must have a DeletionPolicy property specified (which value they have is not relevant, but the attribute must be defined), and the stack cannot declare Outputs or Exports. However, after you've created the stack as an import operation, you can update it as usual, including adding the Outputs section and modifying or removing the DeletionPolicy property, if you so wish.

專家

已回答 2 年前

專家

已審閱 2 年前

0

No it is not possible to recreate same KMS Key. Once deleted, it cannot be recovered. https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kms-key.html when you delete KMS Key from cloudformation, it will be marked for delete for period like 7-30 days. During pending deletion period, it cannot be used for operations.

If you create new cloudformation satck with KMS, new Key gets created with different key material. It is always better to disable key than delete. you can reenable key in cased needed. During key in disable state cannot be used for operations.

AWS
專家

已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。