Examkin

Soru

Zorluk: OrtaAWS Key Management Service (KMS) and Data Encryption

A SysOps Administrator is managing an Amazon S3 bucket containing millions of objects encrypted using Server-Side Encryption with AWS KMS keys (SSE-KMS). Due to a high volume of read and write requests to the bucket, the organization has noticed a significant increase in AWS KMS API costs. The administrator needs to reduce these KMS API charges with minimal operational overhead. Which action should the administrator take to meet this requirement?

  1. Enable S3 Bucket Keys on the S3 bucket configuration.Cevap
  2. B
    Configure a KMS grant for the Amazon S3 service principal that authorizes the GenerateDataKey and Decrypt actions with a custom duration constraint.
  3. C
    Create an S3 Lifecycle rule to transition the objects to Amazon S3 Glacier Instant Retrieval after 1 day.
  4. D
    Enable detailed monitoring for S3 request metrics and configure an Auto Scaling cooldown period to throttle request rates during peak hours.

Cevap

Enable S3 Bucket Keys on the S3 bucket configuration.
The correct answer is to enable S3 Bucket Keys. S3 Bucket Keys decrease the request traffic from Amazon S3 to AWS KMS by creating a bucket-level key that is used to derive unique data keys for objects. This reduces the KMS API call volume for GenerateDataKey and Decrypt by up to 99 percent, directly reducing costs with a simple bucket setting change.

Adım Adım Çözüm

1
Analyze the cause of high AWS KMS API costs in the S3 bucket configuration.
The costs are driven by S3 making KMS API calls (GenerateDataKey and Decrypt) for every single read and write request when using standard SSE-KMS.
Understanding the source of the API calls is necessary to identify how to reduce them.
2
Evaluate S3 features designed to minimize KMS interactions.
S3 Bucket Keys create a bucket-level key generated by KMS. S3 uses this bucket-level key to encrypt and decrypt object-level keys locally within S3.
Caching the key within S3 reduces the frequency of outbound API calls from S3 to KMS.
3
Select the option that configures this optimization with minimal operational effort.
Enabling S3 Bucket Keys directly in the S3 bucket settings achieves this without policy or application modifications.
This is the native, AWS-recommended mechanism for S3 KMS cost reduction.

Anahtar Kavram

S3 Bucket Keys reduce KMS API costs by caching a bucket-level key within the S3 service, decreasing call volume to KMS.
Bu soruyu puanla

Konular

AWS Key Management Service (KMS) and Data Encryption

Bu konudan daha fazla soru