Query: kms_cmk_unused

select
  arn as resource,
  case
    when not enabled
    and key_state = 'PendingDeletion' then 'ok'
    when not enabled
    and key_state <> 'PendingDeletion' then 'alarm'
    else 'ok'
  end as status,
  case
    when not enabled
    and key_state = 'PendingDeletion' then title || ' scheduled for deletion in ' || extract(
      day
      from
        deletion_date - current_timestamp
    ) || ' day(s).'
    when not enabled
    and key_state <> 'PendingDeletion' then title || ' is unused.'
    else title || ' is in use.'
  end as reason,
  region,
  account_id
from
  aws_kms_key
where
  key_manager = 'CUSTOMER';