Closed Rabadash8820 closed 2 years ago
Update: I have verified that when I disable the KMS CMK that backs one of our domains' DNSSEC KSKs, the corresponding DNSSECKeySigningKeysNeedingAction
alarm for that domain is then triggered within the next 24 hours.
See Monitoring hosted zones using Amazon CloudWatch for details.