An analytics pipeline writes millions of small objects per hour to a bucket encrypted with a customer managed KMS key. KMS request charges and throttling are rising. Which bucket setting cuts the number of KMS requests while keeping the same customer key?
Show answer and explanation
Answer: B
S3 Bucket Keys let S3 obtain a bucket-level key from KMS and derive per-object data keys from it. Far fewer kms:GenerateDataKey and kms:Decrypt calls reach KMS, which lowers both cost and throttling pressure. The same customer managed key remains the root of protection, so the compliance requirement is still met. Existing objects are not converted automatically, so new writes benefit first.
Why the other options are wrong
- A. SSE-C requires the client to supply and manage keys on every request, and it does not use the customer KMS key at all. It adds key-handling risk and does not reduce KMS calls on that key.
- C. SSE-S3 removes KMS from the path, which does lower KMS calls, but it no longer uses the customer managed key the company is required to use. It fails the stated control.
- D. CloudTrail data events record API activity for auditing. They do not change how S3 obtains data keys from KMS, so KMS request volume stays the same.