‫So now let's talk about a cool new settings
‫for your S3 Buckets using it with SSE-KMS encryption.
‫And this is a new setting
‫which will allow you to decrease and wait for it.
‫The number of API calls made to KMS from Amazon S3
‫when you use the SSE-KMS type of encryption by 99%.
‫Which will reduce the cost of your overall KMS encryption
‫used by Amazon S3 by also 99%.
‫And how does this work?
‫Well, this leverages data key
‫and more importantly,
‫this thing called an S3 bucket key.
‫So how does that work?
‫Well, a customer master key and KMS
‫is going to be used to generate
‫a data key for your Amazon S3 Bucket once in a while
‫and this key will rotates.
‫But, once in a while and this key's called
‫an Amazon S3 Bucket key.
‫And this key is what's going to be used to encrypt objects
‫in your Amazon S3 Buckets with KMS encryption.
‫So this extra bucket key is going to generate
‫a lot of data keys using envelope encryption
‫which is going to go into encrypting your S3 Buckets.
‫But by adding an S3 Bucket key
‫and not using KMS directly
‫to generate these data keys,
‫we are reducing the number
‫of API calls we are making into KMS.
‫And therefore, we are reducing our costs by a lot.
‫And so this is an optimization
‫of using SSE-KMS to decrease the number
‫of KMS API calls in order,
‫for example, not to have a high bill
‫or not to go over the limits of encryption
‫within your Amazon S3 Buckets
‫but without compromising on security.
‫The result of that is that you will see
‫less CloudTrail events regarding KMS in CloudTrail.
‫And also, you will have
‫a way way lower costs as I said in KMS.
‫So that's it for this lecture.
‫A very good setting to know,
‫especially if you use SSE-KMS at Scale
‫were very high for both.
‫Now let me show you where you can find
‫that setting in the S3 Console.
‫So let's go into the S3 Console
‫and I'm going to create a new buckets.
‫So I'm going to create a buckets
‫and I'll call it,
‫(keyboard typing) ‫Demo S3 Buckets key.
‫Okay?
‫Then we'll block, public settings.
‫We'll disable, versioning.
‫We'll enable, encryption.
‫And it's going to be SSE-KMS,
‫and it's going to be managed key.
‫(mouse clicking)
‫And we are going to enable, bucket keys.
‫So by default, it is enabled now,
‫but we could disable it
‫if we wanted to get every single upload to talk to KMS.
‫But, if you want to enable it
‫we'll just click on enable.
‫And this will use the bucket key to decrease the cost
‫and the number of calls made to KMS
‫without losing any security.
‫So fairly easy,
‫then we create the buckets
‫and we're good to go.
‫And we're now using the bucket key
‫for encryption into our S3 Buckets.
‫So that's it, I will see you in the next lecture.