Why KMS API Costs Can Outpace Your Database Bill
AWS KMS charges Customer Managed Keys (CMKs) on two separate axes: a flat $1.00 per key per month, plus $0.03 per 10,000 API requests such as Decrypt and GenerateDataKey. The request fee is the one teams miss. If every transaction triggers a KMS call — the default for envelope encryption without caching — a service running at 1,000 TPS generates roughly 1000 × 730 × 3600 ≈ 2.6 billion requests a month, which alone works out to close to $7,900 in KMS fees, frequently dwarfing the underlying database's compute cost. This tool reproduces that math directly: it multiplies your tps input by seconds-per-month (730 hours), applies your Data Key Cache Hit Ratio, and plots the resulting KMS bill against your database's monthly cost.
Data Key Caching Is the Lever, Not Envelope Encryption Itself
The AWS Encryption SDK's local data key cache lets a process reuse a decrypted data key for a configurable number of operations or time window, instead of calling KMS on every record. A 0% hit ratio means every transaction round-trips to KMS; a 90% hit ratio drops API request volume — and cost — by roughly 10x. Because the flat $1.00-per-key monthly charge doesn't scale with traffic, caching is the only variable that keeps the request-fee side of the bill from growing linearly with TPS.
Two Ways Out If KMS Wins
- Raise the cache hit ratio: tuning the SDK's max age and max-uses-per-cached-key settings is free and requires no infrastructure change.
- Switch to an AWS managed key: managed keys (e.g.
aws/s3) aren't billed per API request at all — only CMKs are — but you lose custom key policies, cross-account grants, and manual rotation control.