Skip to content

Key-Encryption Key Still Wraps Key Material

URI: https://docs.ankatech.co/errors/kek-destruction-wraps-material
HTTP Status: 409 Conflict

When you see this

A platform administrator asked to destroy one of a tenant's retired key-encryption keys at the provider or HSM that holds it, and the request was refused. The key keeps its status, the provider was not asked to destroy anything, and the refusal is recorded in the audit trail as DENIED.

A tenant key-encryption key is destroyed at its provider or HSM, never only in the platform's records. A destruction request moves a RETIRED key to PENDING_DESTRUCTION and calls no provider: the platform holds the destruction for the deployment's waiting period (30 days by default), and until it ends a cancel returns the key to RETIRED with no provider call. When the period ends the platform checks the key again and only then asks its provider or HSM to destroy it; the key becomes DESTROYED only once a read of the provider confirms it gone. Until then the destruction can be cancelled while the key object still exists, which returns the key to RETIRED.

Common Causes

  • The platform counts again, at the request, the key versions of the tenant wrapped under the key, and found at least one. Destroying the key would make that key material unrecoverable.
  • A key version whose wrapping key-encryption key is unknown counts as wrapped under every candidate, so it also blocks the destruction.
  • The same check runs again when the platform's waiting period ends, before the provider or HSM is called. A refusal then is not an answer to a request: nothing is destroyed, the key returns to RETIRED with the refusal reason MATERIAL_WRAPPED, a kek-destruction.execution-failed row with outcome FAILURE, stage EXECUTION_REFUSED and this problem type is filed in the audit trail, and the platform alert kek.destruction.failed is raised. The alert counts the refusal for 7 days, or until a new destruction of the key is requested. A new destruction is a new request, with a new waiting period.

Response Example

{
  "type": "https://docs.ankatech.co/errors/kek-destruction-wraps-material",
  "title": "Key-Encryption Key Still Wraps Key Material",
  "status": 409,
  "detail": "Key material of the tenant is, or may be, wrapped under this key-encryption key, so it cannot be destroyed. Nothing was changed.",
  "instance": "/api/v3/admin/platform/tenants/8f14e45f-ceea-467a-9575-0d5b2a1f3c11/key-custody/keks/3c1f7a9e-2b44-4e0d-8f6a-91d2c7b5e0aa/destroy",
  "timestamp": 1793696400,
  "extensions": {
    "requestId": "9c41e7a2-5b08-4d3f-a6e1-2f7c90b4d815"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

How to Resolve

  1. Re-wrap the tenant's key material under its current key-encryption key, through a rotation or a custody move, and ask again once the key is reported destructionEligible.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.