KMS waste check
Unused KMS Key
unused_kms_key
What it finds
Unused KMS Key: one of the KMS checks in the security & compliance group. Checks in this group look for: configuration gaps on resources you pay for: missing encryption, missing deletion protection, public exposure, uncovered backups.
Why it costs money
These are posture findings first. Some also carry a cost, such as a resource nobody backs up or protects properly, and the report labels which is which.
How it is detected
Runs in the partner build and the paid hosted tiers.
AWS's own tools
None of Trusted Advisor, Cost Optimization Hub or Compute Optimizer flags this.
Checked against the AWS documentation.
Where this check runs
This check ships in the partner build, for consultancies that scan client accounts, and in the paid hosted tiers.