SAA-C03 Practice Question 79: S3 Bucket Keys KMS Cost

Without a bucket key, S3 uses an individual KMS data key per object, so it calls KMS on every single request against a KMS-encrypted object, which is why billions of small objects produce a KMS bill larger than the storage bill. An S3 Bucket Key has S3 fetch a short-lived bucket-level key from KMS and use it to derive data keys for a period, cutting KMS request costs by up to 99 percent and cutting the request rate correspondingly, which also relieves the throttling. The object stays encrypted under the same customer managed key, so compliance is unaffected, and no client code changes. The CopyObject step matters: enabling the setting applies only to new objects, so existing objects must be rewritten to use it.

Option A treats the symptom. A higher quota stops the throttling but leaves the charge that is already larger than the storage cost, and the question asks for that cost to come down.

Option C would reduce the KMS charges to nothing, because SSE-S3 makes no KMS requests at all. It fails the compliance requirement outright: the objects would no longer be encrypted with the customer managed key.

Option D confuses aliases with keys. An alias is just a friendly name pointing at a key, so several aliases for the same key spread nothing. Even genuinely separate keys would leave the per-object, per-request call pattern intact; the number of KMS requests would be unchanged, merely divided among more keys.

Reference: Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys