KMS key cost vs request cost: which one dominates your bill

Quick answer

AWS KMS bills two ways: $1 per month for each customer-managed key you create, and $0.03 per 10,000 API requests (encrypt, decrypt, generate data key, and so on). AWS-managed keys have no monthly fee, only request charges. For most setups the key fee dominates: a dozen keys is $12 a month with modest request volume. But a high-throughput application calling KMS on every operation can flip this: 100 million requests a month is about $300 in request charges, dwarfing the key fees. The lesson: reduce request volume with data key caching and envelope encryption, because at scale requests, not keys, drive the KMS bill.

AWS KMS is cheap enough that most teams never think about its cost, and for small workloads that is correct. But KMS has two independent charges, one per key and one per request, and which one dominates depends entirely on how your application uses encryption. Knowing which side you are on tells you what to optimize.

The two charges

Charge	Rate
Customer-managed key	$1/month per key
AWS-managed key	No monthly fee
API requests	$0.03 per 10,000 requests

Every customer-managed key (one you create and control) costs $1 per month whether or not you use it. AWS-managed keys, created automatically for services like S3 and EBS, carry no monthly fee. On top of the key fee, every KMS API call, encrypt, decrypt, generate data key, re-encrypt, and the rest, costs $0.03 per 10,000 requests. Asymmetric and ECC operations cost more per request.

When keys dominate

For most applications, the key fee is the whole bill. A team with twenty customer-managed keys pays $20 a month, and if the application encrypts and decrypts at modest volume, the request charges are a few dollars. Here the optimization is simple: do not create keys you do not need. Consolidating where security policy allows, and using AWS-managed keys (free monthly) where a customer-managed key's extra control is not required, trims the fee directly.

When requests dominate

High-throughput applications flip the equation. An application that calls KMS to decrypt on every request, or encrypts many small items individually, can generate tens or hundreds of millions of calls a month. At $0.03 per 10,000, 100 million requests is about $300, far more than any reasonable number of keys. A service decrypting a secret on every single request instead of caching it is the classic cause. Here the key fee is noise and the request volume is everything.

Cutting request-driven cost

The main tool is envelope encryption with data key caching: instead of calling KMS to encrypt or decrypt each item, KMS generates a data key once, you cache it, and use it locally for many operations, calling KMS only occasionally to unwrap the data key. This can cut KMS requests by orders of magnitude. Caching decrypted secrets rather than decrypting on every request has the same effect. These patterns turn a request-dominated KMS bill back into a key-dominated one. KMS request cost also interacts withSecrets Manager, which calls KMS under the hood, so caching secrets helps both.

Because which charge dominates depends on request patterns you can anticipate, estimate your encryption volume up front. Price your KMS usage against the resource catalog and see the fuller picture in the KMS cost guide so keys and requests are both accounted for before the application ships.

FAQ

How much does AWS KMS cost?

Two charges: $1 per month for each customer-managed key you create, and $0.03 per 10,000 API requests such as encrypt, decrypt, and generate data key. AWS-managed keys have no monthly fee, only request charges. For most setups the key fee dominates, but high-throughput applications making millions of requests can flip the bill so that requests dominate instead.

Does the key fee or request fee dominate the KMS bill?

It depends on usage. For most applications with modest encryption volume, the $1-per-key monthly fee dominates: twenty keys is $20 a month with only a few dollars of requests. But a high-throughput app calling KMS on every operation can generate 100 million requests a month, about $300, dwarfing the key fees. Envelope encryption and caching determine which side you land on.

How do I reduce KMS request cost?

Use envelope encryption with data key caching: KMS generates a data key once, you cache it, and use it locally for many operations, calling KMS only occasionally to unwrap it. This cuts requests by orders of magnitude. Also cache decrypted secrets rather than decrypting on every request. These patterns turn a request-dominated KMS bill back into a cheap key-dominated one.

Are AWS-managed keys cheaper than customer-managed keys?

On the monthly fee, yes: AWS-managed keys have no $1 monthly charge, while customer-managed keys do. Both incur the $0.03 per 10,000 request charge. Use AWS-managed keys where their automatic handling is sufficient, and customer-managed keys only where you need the extra control over key policy, rotation, and access, since that control costs $1 per key per month.

Why is my KMS bill high despite few keys?

Almost certainly request volume. If an application decrypts a secret or encrypts data on every request without caching, it can make tens or hundreds of millions of KMS calls a month. At $0.03 per 10,000, 100 million requests is about $300, far exceeding the key fees. The fix is data key caching and caching decrypted secrets so KMS is called far less often.

How does C3X help with KMS cost?

C3X prices your KMS keys from Terraform before you deploy, so the per-key monthly fees are visible in the pull request. Combined with your expected encryption request volume, that helps you see whether keys or requests will dominate the bill and whether envelope encryption and caching are needed, at design time rather than after a high-throughput app runs up the request charges.

What to do next

Price your KMS keys and encryption before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.