Question

A financial services company stores sensitive customer records in an Amazon RDS database and uses a client-side application to encrypt certain fields before insertion. The application must encrypt small tokens (each under 100 bytes) at very high volume — millions of encryptions per hour. The security team is concerned about KMS API throttling limits and the cost of making a KMS API call for every field. Which approach best addresses both the performance and cost concerns while maintaining strong encryption?

Accepted Answer

Use the KMS GenerateDataKey operation to create a data key, cache the plaintext data key locally using the AWS Encryption SDK with data key caching, and perform envelope encryption of the tokens within the application.

Answer

Call the KMS Encrypt API directly for each token, relying on the default per-account request quota which auto-scales to any volume.

Answer

Store the plaintext KMS key material in the application memory after a single Decrypt call so every token can be encrypted locally without further API calls.

Answer

Enable automatic key rotation on the KMS key so that AWS handles all encryption operations server-side without any API calls from the application.