Prevent KMS Key Deletion with EventBridge and SSM Automation

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

C Create an EventBridge rule to trigger an SSM Automation runbook that cancels the KMS key deletion and sends an SNS notification.

Question

A company has a mobile app for customers. The app’s data is sensitive and must be encrypted at rest. The company uses AWS Key Management Service (AWS KMS). The company needs a solution that prevents the accidental deletion of KMS keys. The solution must use Amazon Simple Notification Service (Amazon SNS) to send an email notification to administrators when a user attempts to delete a KMS key. Which solution will meet these requirements with the LEAST operational overhead?
  1. Create an Amazon EventBridge rule that reacts when a user tries to delete a KMS key. Configure an AWS Config rule that cancels any deletion of a KMS key. Add the AWS Config rule as a target of the EventBridge rule. Create an SNS topic that notifies the administrators.
  2. Create an AWS Lambda function that has custom logic to prevent KMS key deletion. Create an Amazon CloudWatch alarm that is activated when a user tries to delete a KMS key. Create an Amazon EventBridge rule that invokes the Lambda function when the DeleteKey operation is performed. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators.
  3. Create an Amazon EventBridge rule that reacts when the KMS DeleteKey operation is performed. Configure the rule to initiate an AWS Systems Manager Automation runbook. Configure the runbook to cancel the deletion of the KMS key. Create an SNS topic. Configure the EventBridge rule to publish an SNS message that notifies the administrators. Correct Answer
  4. Create an AWS CloudTrail trail. Configure the trail to deliver logs to a new Amazon CloudWatch log group. Create a CloudWatch alarm based on the metric filter for the CloudWatch log group. Configure the alarm to use Amazon SNS to notify the administrators when the KMS DeleteKey operation is performed.

Key Takeaways

The core trap is confusing detection-only solutions (like CloudTrail) or complex custom code (Lambda) with the automated remediation pattern provided by EventBridge triggering SSM Automation Runbooks.

This question tests how to prevent accidental deletion of AWS KMS keys using Amazon EventBridge and AWS Systems Manager Automation while minimizing operational overhead.

Common mistake: Many candidates choose Option D, assuming that monitoring via CloudTrail and alerting via SNS is sufficient, but this fails the requirement to 'prevent' the deletion action itself.

Expert Analysis

Why the Answer Is Correct

Option C is the correct solution because it leverages Amazon EventBridge to detect the DeleteKey API call in real-time. By configuring an AWS Systems Manager (SSM) Automation runbook as a target, the architecture can automatically cancel the scheduled deletion of the KMS key before it completes. This approach requires no custom code, ensuring the least operational overhead compared to Lambda.

Why the Other Options Are Wrong

Option A is incorrect because AWS Config rules are primarily for compliance evaluation and do not natively support cancelling active API calls like key deletion; they typically flag non-compliance rather than preventing it in this context. Option B introduces unnecessary complexity by requiring a custom Lambda function to handle the logic, increasing operational overhead. Option D only provides detection and notification via CloudTrail and CloudWatch alarms but lacks any mechanism to actively stop or cancel the deletion attempt.

Community Comment Notes

Community consensus strongly supports Option C, with many users noting that "AWS Config is for detection, not for prevention" as one commenter explained. Others highlighted that Option C achieves the goal since "KMS keys are not immediately deleted," allowing time for automation to intervene. Some users initially chose D, focusing on auditing, but were corrected that the question specifically demands prevention, not just notification.

Official Reference

https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-and-remediate-scheduled-deletion-of-aws-kms-keys.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question asks for 'prevention' or 'remediation', look for services that can take action (like SSM Automation or Lambda) triggered by events (EventBridge). Avoid options that only provide logging or alerts if the requirement is to stop an action.

Frequently Asked Questions

Why can't I use AWS Config to prevent KMS key deletion?

AWS Config evaluates resource state against rules but cannot directly intercept and cancel active API operations like DeleteKey. It is best for compliance checking, not real-time prevention.

Is Lambda required to prevent KMS key deletion?

No, using Lambda adds significant operational overhead for maintenance and error handling. SSM Automation Runbooks are pre-built, managed templates designed exactly for this type of automated remediation.

More SAA-C03 FAQ →

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 12

  1. Andy_09 👍 14
    Option C https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-and-remediate-scheduled-deletion-of-aws-kms-keys.html
  2. hajra313 👍 10
    option c bcz Option C emerges as the clear winner due to its: Direct event monitoring for the DeleteKey operation Pre-built automation using Systems Manager Automation runbooks Efficient notification via Amazon SNS Minimal code development and operational overhead Reduced risk of accidental deletion with faster response times
  3. knben 👍 4
    I would go with C A -> Config is for compliance B -> No lambda is required, too much complexity C -> It achieves the goal, since KMS keys are not immediately deleted, which gives time to automation to cancel the action D -> Cloudtrail is for auditing
  4. sandordini 👍 3 Answered C
    My educated guess was C. Now, reading the comments, from Hajrá313 and knben I feel confident as well :)
  5. MatAlves 👍 2 Answered C
    "Deletion of an AWS KMS key is scheduled. The scheduled-deletion event is evaluated by an EventBridge rule. The EventBridge rule engages the Amazon SNS topic. The EventBridge rule initiates the Systems Manager automation and runbooks. The runbooks cancel the deletion." https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/monitor-and-remediate-scheduled-deletion-of-aws-kms-keys.html
Show 7 more comments
  1. FlyingHawk 👍 2 Answered C
    A- AWS config is for detection, not for prevention, it cannot cancel the deletion. B is more effort to implement the custom logic to prevent KMS key deletion. C is correct to use EventBridge rule to detect it then config the rule to use AWS System Manager Automation rubook to cancel the deletion and publish the event to SNS. D - does not have action for prevent the deletion of key.
  2. Dammy031 👍 2 Answered D
    Cloud trail helps to keep all invoked API calls in the AWS account which can trail back to the delete call made by a user CloudWatch triggers an alarm when deletion is attempted. SNS sends a notification to the administration about the attempt made. All these met the requirement of the question.
  3. camps 👍 2
    It's D https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-creating-cloudwatch-alarm.html https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-creating-cloudwatch-alarm.html#cloudwatch-alarm-prerequisites
  4. 1dd 👍 2
    C as it " cancel the deletion of the KMS key"
  5. JA2018 👍 1 Answered C
    Option C provides the most streamlined solution with minimal additional components needed (LEAST operational overhead). It directly leverages EventBridge to monitor for KMS key deletion attempts, triggers a Systems Manager Automation runbook to automatically prevent the deletion, and sends notifications through SNS without requiring additional Lambda functions or complex CloudWatch metric filtering.
  6. NayeraB 👍 2 Answered C
    I agree with hajra313
  7. JunsK1e 👍 2 Answered C
    I agree with andy_09

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide