Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3? Why Static RSA and Diffie-Hellman cipher suites have been removed in TLS 1.3?

How keys can be exchanged then? 

https://tools.ietf.org/html/draft-ietf-tls-tls13-28
TLS 1.3 has a huge clean up as having 5 cipher suites. As stated in the RFC document RFC 8446 section 1.2 :


  Static RSA and Diffie-Hellman cipher suites have been removed; all public-key based key exchange mechanisms now provide forward secrecy.


With forward secrecy (also called PFS for Perfect Forward Secrecy), even if one of the site's key is compromised, the previously generated keys are safe since there is no method that can regenerate them. The keys are called ephemeral keys.

You can still use ECDH in TLS 1.3 for key establishment but not statically. This version also named ECDHE where the last E is Ephemeral.

There is one drawback, that is; even if you use FPS, the other side can not only store the keys but can also store all the decrypted messages. You don't/can't know that. Storing is not recommended but you cannot prevent that.

When one side stores the keys, it is the opposite of the forward secrecy. Once the attackers breached into the site that will access all the stored keys, but the system was perfect secrecy! Actually, the keys must be erased after the decryption.

See also, misuse of forward-secrecy on Squeamish Ossifrage's answer.