# Excessive KMS charges from missing S3 bucket key configuration Canonical: https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-kms-charges-from-missing-s3-bucket-key-configuration S3 buckets configured with SSE-KMS but without Bucket Keys generate a separate KMS request for each object operation. By: Kevin Talbierz Updated: 2026-09-28 [Cloud Efficiency Hub](https://www.pointfive.co/efficiency-hub) # Excessive KMS Charges from Missing S3 Bucket Key Configuration The short version S3 buckets configured with SSE-KMS but without Bucket Keys generate a separate KMS request for each object operation. [Kevin Talbierz](https://www.linkedin.com/in/kevin-talbierz/) FinOps Manager @ Accor AWS service [AWS S3](https://www.pointfive.co/efficiency-hub/cloud-services/aws-s3) Category [Storage](https://www.pointfive.co/efficiency-hub/service-category/storage) Reference CER-0229 Type Inefficient Configuration ## Explanation Why the waste happens and who it affects. This behavior results in disproportionately high KMS request costs for data-intensive workloads such as analytics, backups, or frequently accessed objects. Bucket Keys allow S3 to cache KMS data keys at the bucket level, reducing the volume of KMS calls and cutting encryption costs - often with no impact on security or performance. ## Billing model The pricing dimensions that drive this cost. When using SSE-KMS, each encryption or decryption request results in a paid call to AWS KMS. Without S3 Bucket Keys, every object operation triggers a KMS request. Bucket Keys reduce cost by allowing S3 to cache data keys and minimize KMS calls, especially beneficial for high-throughput workloads. ## How to detect How to find it in your estate. - Identify S3 buckets with SSE-KMS encryption enabled - Check if Bucket Keys are disabled or not configured - Analyze object access frequency and KMS request volume - Estimate potential cost savings by enabling Bucket Keys - Prioritize buckets with high object counts or frequent read/write operations ## How to fix How to remove the waste. - Enable S3 Bucket Keys for eligible buckets using SSE-KMS - Document any security exceptions or requirements that prevent Bucket Key use - Note: Enabling Bucket Keys applies only to newly encrypted objects; existing objects must be re-encrypted or re-uploaded to benefit - Track KMS request metrics before and after rollout to validate cost impact ## Documentation Vendor references for pricing and configuration. - [Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html) - [Configuring your bucket to use an S3 Bucket Key with SSE-KMS for new objects docs.aws.amazon.com](https://docs.aws.amazon.com/AmazonS3/latest/userguide/configuring-bucket-key.html) - [AWS Key Management Service pricing aws.amazon.com](https://aws.amazon.com/kms/pricing/) ## Related inefficiencies [Browse the library](https://www.pointfive.co/efficiency-hub) - AWS S3 CER-0054 ### [Excessive CloudTrail Charges from Bulk S3 Deletes](https://www.pointfive.co/efficiency-hub/inefficiencies/excessive-cloudtrail-charges-from-bulk-s3-deletes) When large numbers of objects are deleted from S3 - such as during scripted cleanups or batch jobs that call DeleteObject or DeleteObjects-CloudTrail can log every individual delete operation if data event logging is enabled. This is... Storage - AWS S3 CER-0076 ### [Missing S3 Lifecycle Policy for Incomplete Multipart Uploads](https://www.pointfive.co/efficiency-hub/inefficiencies/missing-s3-lifecycle-policy-for-incomplete-multipart-uploads) Multipart upload allows large files to be uploaded in segments. Each part is stored individually until the upload is finalized by a "CompleteMultipartUpload" request. If this final request is never issued-due to a timeout, crash, failed... Storage - AWS S3 CER-0032 ### [Delayed Transition of Objects to Intelligent-Tiering in an S3 Bucket](https://www.pointfive.co/efficiency-hub/inefficiencies/delayed-transition-of-objects-to-intelligent-tiering-in-an-s3-bucket) Some S3 lifecycle policies are configured to transition objects from Standard storage to Intelligent-Tiering after a fixed number of days (e.g., 30 days). This creates a delay where objects reside in S3 Standard, incurring higher storage... Storage --- Source: the public page above. Product screenshots and illustrative interfaces are examples, not live customer data.