AWS KMS cost explained: $1 per key, then it is all API requests

Quick answer

KMS bills $1 per month per customer-managed key and $0.03 per 10,000 requests. AWS-managed keys cost nothing to hold, but every encrypt, decrypt, or generate-data-key call is a billable request. On high-throughput services the request line dominates, so data-key caching and envelope encryption matter more than key count.

KMS looks free until a service that encrypts on every request meets the per-request charge. There are only two dimensions, keys and requests, and for any busy workload the requests are what you manage.

Keys are a rounding error

A customer-managed key is $1 per month. AWS-managed keys, the ones created for you by S3, EBS, RDS, and friends, cost nothing to hold. Even a hundred customer-managed keys is a hundred dollars a month, which is rarely the problem. Do not consolidate keys for cost reasons; separate keys exist for blast-radius and access control, and the saving is negligible.

Requests are the real bill

Dimension	Rate
Customer-managed key	$1 / month each
API requests	$0.03 / 10,000
Free tier	20,000 requests / month

Three cents per ten thousand sounds like nothing until a service calls Decrypt on every request. A million requests an hour is a million KMS calls an hour if you decrypt naively, and that is real money at scale.

Envelope encryption and data-key caching

The pattern that fixes this is envelope encryption: call KMS once to get a data key, then encrypt many payloads locally with that data key. The AWS Encryption SDK supports data-key caching so you reuse a data key across many operations within a bound, cutting KMS calls by orders of magnitude. This is the single most effective KMS cost control, and it improves latency too.

Watch the services that call KMS for you

S3 with SSE-KMS calls KMS on every object read and write, which on a high-throughput bucket can generate enormous request volume. S3 Bucket Keys reduce that dramatically by using a bucket-level key to lower KMS calls. Similar hidden request volume comes from busy Lambda functions and DynamoDB with customer-managed keys. If a KMS bill surprises you, find the service generating the requests before you touch key configuration. It is the same principle as the reduce-your-cloud-bill checklist: follow the volume, not the sticker.

FAQ

How much does a KMS key cost?

A customer-managed key is $1 per month. AWS-managed keys, created automatically by services like S3 and EBS, are free to hold. Key count is rarely the cost driver, API requests are.

How much do KMS requests cost?

$0.03 per 10,000 requests, with 20,000 free per month. Each encrypt, decrypt, or generate-data-key call is one request, so a service that decrypts on every request can generate large volumes and a meaningful bill.

How do I reduce KMS request cost?

Use envelope encryption with data-key caching (via the AWS Encryption SDK) so you call KMS once and encrypt many payloads locally, and enable S3 Bucket Keys to cut KMS calls on SSE-KMS buckets. Both reduce request volume by orders of magnitude.

Should I consolidate KMS keys to save money?

No. At $1 per key per month the saving is negligible, and separate keys give you blast-radius isolation and finer access control. Consolidate keys only for management reasons, never for cost.

Why is my S3 KMS bill so high?

SSE-KMS calls KMS on every object read and write, so a high-throughput bucket generates large request volume. Enabling S3 Bucket Keys uses a bucket-level key to sharply reduce the number of KMS calls and the associated cost.

Does C3X estimate KMS cost?

C3X prices aws_kms_key from your Terraform so the per-key monthly cost appears before deploy. Request volume depends on how your application and services call KMS, which you provide as a usage assumption.

What to do next

Price your keys and the services around them before deploy. C3X reads your Terraform and prices KMS and the rest of your resources against a live catalog. Start with the quickstart.