fix: add deletion policy to KMS keys (#540)

awslabs · Mar 3, 2022 · 9991809 · 9991809
1 parent 2604e59
commit 9991809
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/cloudformation/kms.yaml b/cloudformation/kms.yaml
@@ -11,6 +11,8 @@ Resources:
       TargetKeyId: !Ref S3KMSKey
   S3KMSKey:
     Type: AWS::KMS::Key
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
     Properties:
       EnableKeyRotation: true
       Description: 'KMS CMK for s3'
@@ -30,6 +32,8 @@ Resources:
       TargetKeyId: !Ref DynamodbKMSKey
   DynamodbKMSKey:
     Type: AWS::KMS::Key
+    DeletionPolicy: Retain
+    UpdateReplacePolicy: Retain
     Properties:
       EnableKeyRotation: true
       Description: 'KMS CMK for DynamoDB'