Question

A company stores millions of objects daily in an S3 bucket that is configured for default encryption using SSE-KMS with a customer managed key. The finance team reports a sharp increase in AWS KMS charges, and CloudTrail shows a very high volume of GenerateDataKey and Decrypt API calls against the KMS key. Security must reduce KMS request costs while keeping all objects encrypted with the same customer managed key. What should the team do?

Accepted Answer

Enable S3 Bucket Keys on the bucket so a bucket-level data key is used to reduce the number of KMS API calls.

Answer

Switch the bucket default encryption to SSE-S3 (Amazon S3 managed keys) to eliminate all KMS calls.

Answer

Disable automatic key rotation on the customer managed key to lower the number of KMS requests.

Answer

Use SSE-C so the client supplies the encryption key and no KMS requests are generated.