Scenarios
Once a key is deleted, it cannot be recovered, and all data encrypted under that key will become undecryptable. To prevent accidental deletion, KMS employs a scheduled deletion mechanism, which enforces a waiting period of 7 - 30 days for deletion operations. During this waiting period, you can cancel the deletion of a scheduled key.
You can log in to the Tencent Cloud KMS (Compliant) console or call the KMS TCCLI to schedule or cancel the scheduled deletion of a key. How to delete a key through the console is described in detail in this document.
Operation Steps
1. Log in to the KMS (Compliant) console. In the left sidebar, click Key Management > Data Key. 2. On the data key management page, select the key you want to schedule for deletion. In the Operation column, choose More > Schedule Deletion. If the key is currently enabled, disable it first.
3. Enter the scheduled deletion days and click OK. After the scheduled deletion and the specified days are confirmed, the key will be deleted as scheduled.
Attention:
The scheduled deletion days can be set to a value between 7 and 30 days. Once a key is deleted, it cannot be recovered, and all data encrypted under that key will become undecryptable.
To prevent accidental deletion, the KMS service will automatically trigger an alarm for the following operations:
Before a key is permanently deleted, the system will trigger an alarm for any attempt to call that key.
An alarm will be triggered daily during the three days before a key is permanently deleted.
4. To cancel the deletion of a key, click Cancel Deletion. After the cancellation is confirmed, the key is reset to the "Disabled" state, and you can then enable, modify, or delete it.