Unused AWS KMS Keys: The Monthly Fee and How Deletion Works

So you check an AWS bill and realize you are paying every single month for a cryptographic lock that is just, you know, sitting there guarding absolutely nothing. Today, we are looking at the billing mechanics of unused AWS KMS customer managed keys and how deletion works. Yeah, exactly. A KMS key that sits unused still bills this monthly fee. It is cheap per key, so the issue is many forgotten keys, not just one.

Wait, I actually need to push back on that foundational premise. Like, why do we pay a monthly fee for a cryptographic resource even when it just sits there doing absolutely nothing? Well, you are being billed for the control and existence of that specific resource. Every single customer-managed key you create costs $1 a month, prorated hourly. Oh, okay.

Just a flat $1 a month. Right. And the same $1 applies to symmetric, asymmetric, HMAC, and multi-region keys. That is, each primary and each replica. But wait, that doesn't apply to every single key in an account, right?

Because AWS creates keys automatically for certain services. Yeah, that is true. AWS managed keys and AWS owned keys, the ones AWS creates for you when an integrated service first encrypts something, are not charged for creation and storage. Okay, so they are free to store. Yes.

And you cannot delete those anyway. So the billing really just applies to the customer managed keys. Got it. Okay, so it is $1 a month for those. What about when we rotate them, you know, to maintain good security practices?

So automatic or on-demand rotation adds one more dollar a month for the first rotation and one more for the second, then the increase stops. Wait, it just stops after the second rotation? Yeah, exactly. And for the actual usage math, the free tier allows 20,000 requests a month across all regions. Oh, okay.

So if we look at the specific AWS worked example, one key and 750 requests in a month costs $1 because 750 is inside the free requests. That is the math right there. You are paying for the key just to exist. Okay, so how do we actually find out if a key is doing any work? I mean, does AWS provide an easy metric for this?

No, KMS does not store how many ciphertexts a key made. So you work out past usage yourself, and CloudTrail records KMS API calls. So you just have to work out past usage yourself through CloudTrail. Right. Let us say you do that and decide a key needs to go.

Well, if you are not sure, disable the key first. Just disable it, not delete it. Right, because a disabled key can be re-enabled. That gives you a reversible way to stop it from being used without destroying the key material. Okay, that makes complete sense as a first step.

Yes. But if you actually move past disabling and schedule deletion, it is a scheduled wait of 7 to 30 days, default 30, up to 24 hours longer. Wait, up to 24 hours longer than the scheduled wait? Yes, exactly. And during this wait, the key is in a state called pending deletion.

It cannot be used in any cryptographic operation. And you can cancel the deletion. And AWS suggests a cloud watch alarm to warn you if someone or something tries to use a key during the waiting period, right? They do, yeah. And you have to watch out for asymmetric keys used for encryption.

People can keep making ciphertext with the public key that can never be decrypted after the private key is gone. Oh, wow. Yeah, that is a critical detail. So if that CloudWatch alarm fires and we realize we made a mistake, how does the billing work for that pending time? So AWS says there is no charge for a customer managed key that is scheduled for deletion.

But if we cancel it? If you cancel, the key is charged as though it was never scheduled for deletion. Ah, got it. Okay. And if we do not cancel, after that wait, the key material is deleted and data encrypted under it can no longer be decrypted.

Yes, exactly. There is a free, read-only, source-available command line tool, PIP Install cloudcostwise, that runs on your machine against about 20 AWS services and sends nothing to CloudWise.