Help Center/ Object Storage Service/ User Guide/ Data Security/ Server-Side Encryption/ Using OBS Bucket Keys to Reduce SSE-KMS Costs
Updated on 2026-08-21 GMT+08:00
View PDF
Share

Using OBS Bucket Keys to Reduce SSE-KMS Costs

When you use SSE-KMS to encrypt a large number of objects, OBS must request KMS to derive a data encryption key (DEK) for each object. This results in high request volume, increased latency, and heavy traffic to KMS. By caching bucket keys in OBS and limiting their validity period, OBS reduces its interactions with KMS. This lowers KMS traffic for encryption and decryption operations, thereby reducing costs and improving performance.

Bucket Key Principles

Figure 1 Derivation process of bucket keys and DEKs

As shown in this figure, a bucket key works as follows:

  1. KMS generates a bucket key with a short validity period. The default rotation period is 365 days. You can configure this period by setting the BucketKeyRotationPeriod parameter in the API that configures encryption for a bucket.
  2. OBS stores the bucket key in its own cache for about 3 minutes.
  3. OBS uses the cached bucket key to derive DEKs for encrypting and decrypting objects, without sending requests to KMS. During encryption and decryption, KMS manages the CMK and the bucket key, while OBS caches the bucket key and stores and manages the derived DEKs.

Constraints

  • Currently, cross-region replication does not support bucket keys.
  • To secure data, each requester obtains a unique bucket-level key from KMS at least once to ensure that KMS can check whether the requester has access to the key. OBS treats callers as different requesters when they use different IAM users or the same IAM user with different permissions.
  • To configure a bucket key for an existing object that does not use the bucket key, you need to re-upload or copy the object and enable the bucket key at the object level in the upload or copy request.

Billing

If you use SSE-KMS, you will be billed for using keys. For details, see KMS Billing Items.

Bucket-Level and Object-Level Bucket Keys

OBS supports bucket-level and object-level bucket keys. Objects can inherit the encryption settings from their bucket, or you can separately configure encryption for objects. For details, see Figure 2. In an OBS request, if x-obs-server-side-encryption-bucket-key-enabled is set to true, the bucket key is enabled; if this header is set to false, the bucket key is disabled.

Figure 2 Bucket-level and object-level bucket keys working together
Parent Topic: Server-Side Encryption