A large number of S3 objects use SSE-KMS encryption.
Retain the encryption protection while reducing KMS requests and their cost.
Which feature is most appropriate?
Enable an S3 Bucket Key so S3 can reduce the number of KMS requests used for objects encrypted with SSE-KMS.
Detailed explanation
Making the key broadly available removes the encryption access boundary.
Making the key broadly available removes the encryption access boundary.
Removing encryption violates the requirement to protect the stored objects.
Removing encryption violates the requirement to protect the stored objects.
S3 Bucket Key reduces KMS requests for SSE-KMS objects while retaining server-side encryption with a KMS key.
S3 Bucket Key reduces KMS requests for SSE-KMS objects while retaining server-side encryption with a KMS key.
A cache TTL controls content freshness and does not reduce KMS calls made for S3 encryption.
A cache TTL controls content freshness and does not reduce KMS calls made for S3 encryption.
Check official documentation
Compare the following points with the official documentation.
S3 Bucket KeyとSSE-KMSの公式説明を確認する。
What to confirm
SSE-KMSの保護を維持しながらKMS利用を効率化できる。
Key points
- S3 Bucket Key
- SSE-KMS
- KMS request volume
Notes
- Environment: AWS公式S3・KMSドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Protection and efficiency
Bucket Key lowers KMS request volume without switching off the encryption control.
Data path scope
CloudFront caching affects delivery requests, not the KMS calls involved in S3 encryption.