AWS KMS keys should not be deleted unintentionally

How to fix it

Decide whether the named key is meant to be deleted. This finding reports a state rather than a mistake, so when the deletion was deliberate, do nothing: the waiting period runs, the key is deleted, and the finding clears by itself. That waiting period is the only chance to reverse it, and once the key is gone everything encrypted under it is unreadable for good. If the deletion was not intended, cancel it and then enable the key: cancelling leaves it disabled, so anything that depends on it keeps failing while the finding reads clear.

In the console

Key Management Service → Customer managed keys → the key → Key actions

With the AWS CLI

aws kms cancel-key-deletion --key-id <key-id> --region <region>