A company encrypts millions of objects per day in an S3 bucket using SSE-KMS with a customer managed KMS key, and starts hitting AWS KMS request throttling because nearly every PutObject and GetObject call generates a separate request to AWS KMS. Regulatory requirements mandate that objects keep using SSE-KMS with a customer managed key, so switching to a different encryption method is not an option. What should the company do to cut the number of calls reaching AWS KMS?
- Switch the bucket to SSE-C so the company manages keys itself instead of KMS
- Enable an S3 Bucket Key for SSE-KMS on the bucket, which uses a time-limited bucket-level key to derive data keys instead of calling KMS for every request
- Switch to SSE-S3 encryption, which does not use AWS KMS at all
- Disable default bucket encryption so PUT requests no longer trigger any encryption workflow
Why B? And why not the others?
Correct answer: B. Enable an S3 Bucket Key for SSE-KMS on the bucket, which uses a time-limited bucket-level key to derive data keys instead of calling KMS for every request
An S3 Bucket Key is a bucket-level key that AWS KMS generates and that Amazon S3 reuses, for a time-limited period, to derive unique data keys for objects in that bucket, which can reduce the volume of requests reaching AWS KMS by up to 99 percent compared with requesting a fresh data key from KMS for every single object request. That directly relieves KMS request throttling while the objects continue to be encrypted with the same customer managed KMS key, satisfying the regulatory requirement. Moving to SSE-C would put key management entirely on the client and abandon the mandated customer managed KMS key, which the requirement rules out. Moving to SSE-S3 would stop using AWS KMS entirely, also violating the mandate, even though it would incidentally solve the throttling. Disabling default bucket encryption does not reduce KMS calls in any useful way and abandons encryption requirements altogether, which the company cannot do.
Source: AWS S3 docs: Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys