Hit limit of KMS keys
JosephSalisbury opened this issue · comments
{"caller":"github.com/giantswarm/aws-operator/service/create/service.go:233","error":"could not encode TLS assets: [{/go/src/github.com/giantswarm/aws-operator/service/create/assets.go:15: } {/go/src/github.com/giantswarm/aws-operator/service/create/encrypt.go:87: } {InvalidParameter: 1 validation error(s) found.\n- minimum field size of 1, EncryptInput.KeyId.\n}]","time":"17-04-24 08:45:47.403"}
It looks like we hit the (1K) limit of KMS keys
Let's make sure we delete the key when deleting a cluster, I think that's the best we can do here
@JosephSalisbury You cannot explicitly remove the key, you can only schedule a deletion which happens after ~1 day. We are currently doing that: https://github.com/giantswarm/aws-operator/blob/master/resources/aws/kms.go#L58-L63
for my learning, from http://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html it looks like the minimum time period is 7 days?
You can set the waiting period from a minimum of 7 days up to a maximum of 30 days.
but cool that we already schedule for deletion
Yes good we're scheduling the key for deletion but we're using the default which is 30 days. We may want to reduce to 7 days.
https://godoc.org/github.com/aws/aws-sdk-go/service/kms#ScheduleKeyDeletionInput
OK, will do that.