Question

A SysOps administrator manages an S3 bucket that stores millions of small objects, all encrypted with server-side encryption using an AWS KMS customer managed key (SSE-KMS). After enabling encryption, the AWS bill shows a large increase in AWS KMS request charges because every object upload and download triggers a separate KMS API call. The administrator must reduce KMS costs while keeping the objects encrypted with the same KMS key. What is the MOST cost-effective action?

Accepted Answer

Enable S3 Bucket Keys on the bucket to reduce the number of KMS API calls.

Answer

Switch the bucket to SSE-S3 (Amazon S3-managed keys) to eliminate all KMS charges.

Answer

Enable automatic key rotation on the KMS key to consolidate encryption requests.

Answer

Move the objects to S3 Glacier Flexible Retrieval to avoid frequent KMS decryption calls.