AWS KMS launches GetKeyLastUsage API for key management

Introduction of GetKeyLastUsage API

AWS Key Management Service (KMS) has launched the GetKeyLastUsage API, allowing users to quickly ascertain the last time a key was involved in a cryptographic operation. This API is beneficial for organizations managing multiple keys across various AWS accounts and regions.

Challenges in Key Management

Previously, users had to rely on AWS CloudTrail logs to audit key usage. While CloudTrail records every cryptographic operation, leveraging this data for insights required significant effort in querying logs. Users needed to identify which keys to examine and continuously monitor the logs for accuracy.

Benefits of the New API

With the introduction of the GetKeyLastUsage API, users can now directly see the last key utilization date and time, along with operation type, without sifting through CloudTrail logs. This increase in accessibility enhances audit capabilities and simplifies key lifecycle management.

Policy Enforcement with Last Usage Data

The API also allows users to prevent keys from being disabled or scheduled for deletion if they have been recently used. This feature integrates the last usage information into KMS key policies, safeguarding against accidental deletions.