---
title: Disabling or deletion of Customer-Managed Keys should be monitored
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Disabling or deletion of
  Customer-Managed Keys should be monitored
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Disabling or deletion of Customer-Managed Keys should be monitored
 
## Description{% #description %}

AWS IAM accounts should have at least one active multi-region CloudTrail trail that captures all management events (an event selector with `IncludeManagementEvents` set to true and `ReadWriteType` set to `All`), sends logs to CloudWatch Logs, and has a metric filter matching customer-managed keys (CMKs) that are disabled or scheduled for deletion. The metric filter must be linked to a CloudWatch alarm that notifies an SNS topic with at least one confirmed subscriber, so that loss of access to encrypted data is detected quickly.

## Remediation{% #remediation %}

1. Create a metric filter on the multi-region trail's log group using the pattern `{($.eventSource = kms.amazonaws.com) && (($.eventName=DisableKey)||($.eventName=ScheduleKeyDeletion)) }` as described in the [AWS CloudWatch Alarms for CloudTrail User Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html) and the [put-metric-filter CLI reference](https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html).
1. Create an SNS topic with at least one subscription following [Subscribing to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html), then create a CloudWatch alarm on the metric (Sum, period 300, threshold 1, `GreaterThanOrEqualToThreshold`) whose alarm action targets the SNS topic ARN.

## References{% #references %}

- [AWS CLI put-metric-filter reference](https://docs.aws.amazon.com/cli/latest/reference/logs/put-metric-filter.html)
- [Subscribing to an Amazon SNS topic](https://docs.aws.amazon.com/sns/latest/dg/sns-create-subscribe-endpoint-to-topic.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)