Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company stores large volumes of sensitive transactional data in an Amazon S3 bucket. The data is encrypted at rest using Server-Side Encryption with AWS KMS Customer Managed Keys (SSE-KMS). Due to high read and write request volumes, the company is experiencing high AWS KMS costs and is occasionally throttled by AWS KMS API limits. Which action should the solutions architect take to resolve this issue with minimal changes to the application?

  1. A
    Enable automatic key rotation on the KMS Customer Managed Key to distribute the cryptographic workload.
  2. B
    Configure SSE-S3 encryption for the S3 bucket, and store the plaintext encryption keys as String parameters in Systems Manager Parameter Store to perform client-side encryption.
  3. Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.Answer
  4. D
    Deploy an S3 Gateway Endpoint in the VPC and route all AWS KMS API traffic through it to eliminate KMS request charges.

Answer

Configure the Amazon S3 bucket to use an S3 Bucket Key for server-side encryption.
Configuring an Amazon S3 Bucket Key for server-side encryption allows S3 to use a bucket-level key derived from AWS KMS. This key is used to encrypt new objects in the bucket, significantly reducing the volume of calls S3 makes to AWS KMS (by up to 99%). This reduces costs and mitigates API throttling without any modifications to the application.

Step-by-Step Solution

1
Analyze the cause of high AWS KMS costs and throttling.
The issue is caused by the high volume of direct API requests from Amazon S3 to AWS KMS for encrypting and decrypting individual objects.
Each S3 read/write operation under standard SSE-KMS generates a call to AWS KMS to decrypt or generate a data key.
2
Evaluate solutions that reduce the frequency of direct KMS API calls.
Amazon S3 Bucket Keys reduce KMS request traffic by deriving key material at the bucket level instead of making a KMS call per object.
An S3 Bucket Key serves as a temporary, bucket-level key cached by S3, minimizing KMS API interactions.
3
Implement the S3 Bucket Key configuration.
AWS KMS request traffic is reduced by up to 99%, resolving both the high costs and throttling limits.
This is a configuration change on the S3 bucket level and requires zero changes to application code.

Key Concept

Amazon S3 Bucket Keys for SSE-KMS
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic