A company has been using the AWS KMS service for managing its keys. They are planning on carrying out housekeeping activities and deleting keys that are no longer in use. What are the ways that can be incorporated to see which customer master keys are still being used? Choose 2 answers from the options given below.

Answer options:

A.Determine if the age of the customer master key is over 90 days.
B.Examine CMK permissions to determine the scope of potential usage.
C.Examine AWS CloudTrail logs to determine the actual usage.
D.Check Trusted Advisor to see if the customer master keys can be safely deleted.

Answer: B and C
Option A is incorrect because seeing how long ago the key was created would not determine the usage of the key.
Option B is CORRECT because determining who or what currently has access to a customer master key (CMK) might help you, determine how widely the CMK was used and whether it is still needed.
Option C is CORRECT because AWS KMS is integrated with AWS CloudTrail, so all AWS KMS API activity is recorded in CloudTrail log files. If you have CloudTrail turned on in the region where your customer master key (CMK) is located, you can examine your CloudTrail log files to view a history of all AWS KMS API activity for a particular CMK, and thus its usage history. You might be able to use a CMK`s usage history to help you determine whether or not you still need it.
Option D is incorrect because Trusted Advisor does not provide such information.
For more information on determining the usage of CMK keys, kindly visit the following URL:
https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys-determining-usage.html