DEA-C01 Practice Question 40: S3 Bucket Key KMS Cost

Without a bucket key, "Amazon S3 uses an individual AWS KMS data key for every object. In this case, Amazon S3 makes a call to AWS KMS every time a request is made against a KMS-encrypted object"; hundreds of millions of objects means hundreds of millions of KMS requests, which explains both the bill and the throttling. An S3 Bucket Key generates a short-lived bucket-level key that produces data keys for objects within Amazon S3, and "using a bucket-level key for SSE-KMS can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS." Fewer requests also means the KMS request-rate limit stops being hit. The same customer managed key remains the root of trust, so the security requirement holds. Two details matter in practice: "objects that are already in the bucket do not use the S3 Bucket Key", hence the CopyObject rewrite, and bucket keys use the bucket ARN rather than the object ARN as the encryption context, so any policy that conditions on the object ARN must be updated.

Option B violates the stated requirement. SSE-S3 uses keys Amazon S3 manages; the customer managed key, its key policy, and the control that comes with it are gone.

Option C treats the symptom and only half of it. A quota increase may stop the throttling, but the workload still issues one KMS request per object operation, so the cost problem, the other half of the question, is untouched.

Option D moves in the wrong direction. DSSE-KMS applies two layers of KMS-based encryption, which increases KMS work rather than reducing it, and the documentation states that "S3 Bucket Keys aren't supported for DSSE-KMS", so the cost mitigation is unavailable.

Reference: Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys