Question

A company stores billions of small objects in an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key. Their monthly bill shows a very large number of AWS KMS API requests (GenerateDataKey and Decrypt), and the KMS request charges have become a significant cost. The security team requires that objects remain encrypted with the same customer managed key and that all access continues to be authorized against that key. What is the MOST cost-effective way to reduce the KMS request charges?

Accepted Answer

Enable S3 Bucket Keys on the bucket so that a bucket-level data key is used to encrypt objects, reducing the number of KMS requests.

Answer

Change the bucket default encryption to SSE-S3 (Amazon S3 managed keys) to eliminate KMS request charges entirely.

Answer

Enable automatic annual rotation on the customer managed key to reduce the frequency of GenerateDataKey calls.

Answer

Create a KMS grant for the S3 service principal so that S3 caches the data key and stops calling KMS for each object.