Question

A financial services company stores millions of small objects (each under 100 KB) in a single S3 bucket. Compliance requires that all objects be encrypted at rest with a customer-managed KMS key so that key usage can be audited and access can be revoked independently of S3. After enabling SSE-KMS with a customer-managed key as the bucket default, the security team notices AWS KMS request charges have risen dramatically because every GET and PUT triggers a KMS API call. The team must reduce KMS request costs while still meeting the requirement to use the customer-managed key for auditable, revocable encryption. What should they do?

Accepted Answer

Enable S3 Bucket Keys on the bucket so S3 uses a short-lived bucket-level data key, reducing the number of KMS requests while continuing to use the customer-managed KMS key.

Answer

Switch the bucket default encryption to SSE-S3 (Amazon S3-managed keys) to eliminate KMS request charges entirely.

Answer

Enable automatic annual rotation on the customer-managed KMS key to lower the per-request KMS cost.

Answer

Move the objects to S3 One Zone-IA storage class, which encrypts with the KMS key at a reduced request rate.