S3 Bucket Key
An S3 feature that reduces KMS API calls by up to 99% by caching encryption key material at the bucket level rather than making individual KMS requests per object. Now the primary encryption path as AWS phases out SSE-C for new buckets starting April 2026.
Summary
An S3 feature that reduces KMS API calls by up to 99% by caching encryption key material at the bucket level rather than making individual KMS requests per object. Now the primary encryption path as AWS phases out SSE-C for new buckets starting April 2026.
For S3 workloads with mandatory SSE-KMS encryption (common in regulated industries), Bucket Keys remove the KMS request-rate bottleneck that otherwise limits throughput during high-volume operations like bulk ingestion or compaction. With the SSE-C phase-out (designed to prevent ransomware actors from encrypting victim data with attacker-held keys), Bucket Keys and KMS-based encryption are now the defensive standard.
- Bucket Keys change the request pattern visible in CloudTrail. KMS logs show bucket-level key requests instead of per-object requests, which can affect audit workflows.
- Not supported by all legacy S3 clients. Verify client library compatibility before enabling.
- The SSE-C phase-out affects new buckets first (April 2026). Existing buckets using SSE-C should plan migration to SSE-KMS with Bucket Keys.
depends_onAWS S3 — AWS-specific featurescoped_toS3, Object Storage
Definition
An S3 feature that reduces the number of AWS KMS API calls by associating a bucket-level encryption key that is used to generate data keys for objects, rather than making a separate KMS request for every object operation.
S3 workloads with server-side encryption using KMS (SSE-KMS) can generate enormous volumes of KMS API calls, hitting rate limits and incurring significant costs at scale. Bucket Keys reduce KMS request volume by up to 99% by caching the key material at the bucket level. Starting April 2026, AWS disables SSE-C (Server-Side Encryption with Customer-Provided Keys) for new buckets by default to prevent ransomware syndicates from encrypting victim data with attacker-held keys, making KMS-based encryption via Bucket Keys the primary defensive standard.
Cost and rate optimization for SSE-KMS encrypted S3 buckets, high-throughput encrypted data lake operations, compliance-mandated encryption without KMS bottlenecks, migration target for SSE-C phase-out.
Recent developments
- Up to 99% KMS request-cost reduction; >$80M cumulative customer savings since 2020 launch. AWS's official numbers: enabling S3 Bucket Keys cuts KMS API request volume up to 99% on SSE-KMS buckets. Customers report 50–95% real-world KMS savings. AWS has tracked cumulative customer savings exceeding $80M since the feature launched end of 2020. Per AWS Storage Blog — Reducing AWS KMS Costs by up to 99% with S3 Bucket Keys.
- Real-world case study: $1,500/day → $300/day in KMS request costs ($36K/month savings). Documented customer case — a high-PUT-volume workload went from $1,500/day to $300/day in pure KMS request charges by flipping the Bucket Key switch. No app code changes. Per OneUptime — How to Configure S3 Bucket Key to Reduce KMS Costs.
- Performance: "the single biggest performance optimization" for SSE-KMS workloads. Without Bucket Keys, S3 makes a KMS API call for every object PUT/GET — at $0.03/10K requests, 1M PUTs/day = $90/month + the KMS rate-limit risk. With Bucket Keys, S3 generates a short-lived bucket-level key and handles encryption/decryption locally. Per Binadox — AWS S3 Bucket Keys: Optimize Cost and Security with SSE-KMS.
- Bucket ARN becomes the encryption context (not object ARN) — CloudTrail audit-trail shape changes. Operational implication often missed: with Bucket Keys enabled, AWS KMS CloudTrail events log the bucket ARN instead of the object ARN. Compliance teams expecting per-object audit need to re-tune their detection rules. Per AWS Docs — Reducing the Cost of SSE-KMS with Amazon S3 Bucket Keys.
- Migration: only new objects get the benefit; existing data needs re-encryption. The toggle is bucket-level + forward-looking — existing objects keep their old encryption metadata. To realize savings on a populated bucket, run an in-place copy operation; one-time S3 PUT cost vs ongoing KMS request savings. Per Xebia — Reduce AWS Costs With S3 Bucket Keys.
- Now the defensive default after SSE-C phase-out (April 2026). With SSE-C disabled for all new buckets by default (April 2026 — to defeat the Codefinger ransomware pattern), KMS-based encryption with Bucket Keys is the recommended replacement path for cost-efficient encrypted-at-rest workloads. Per project notes + Carlo Cloud — Reducing AWS KMS Costs with S3 Bucket Encryption.
Connections 3
Outbound 3
scoped_to2depends_on1Resources 2
AWS documentation explaining how S3 Bucket Keys reduce KMS API calls and costs for SSE-KMS encrypted buckets.
Security best practices for S3 including Bucket Key configuration and encryption cost optimization.