aws_s3_bucket_server_side_encryption_configuration cost estimation
Setting default encryption on a bucket is free. Encryption itself adds no charge, but choosing aws:kms means each object request also triggers a billable KMS call.
An aws_s3_bucket_server_side_encryption_configuration sets the default encryption applied to new objects in a bucket. The configuration is free, and SSE-S3 (the AES-256 default, algorithm "AES256") adds no cost at all: S3 encrypts and decrypts objects with S3-managed keys for free. For most buckets, default encryption is a zero-cost setting you should always turn on.
The cost appears when you choose aws:kms and point at a KMS key. With SSE-KMS, every object upload and every read triggers a KMS API call (GenerateDataKey on write, Decrypt on read), each billed at about $0.03 per 10,000 requests, plus roughly $1/month for a customer-managed key. On a low-traffic bucket that is trivial, but on a bucket serving millions of GETs, KMS request charges can exceed the storage cost. S3 Bucket Keys mitigate this by caching a bucket-level data key so S3 makes far fewer KMS calls, cutting KMS request cost by up to 99% on busy buckets.
The optimization is to match the key to the traffic: SSE-S3 for the common case, SSE-KMS with a Bucket Key enabled when you need customer-managed keys or an audit trail. c3x prices the KMS requests that SSE-KMS drives and the key itself, and treats SSE-S3 default encryption as the free setting it is.
Terraform example
A minimal but realistic configuration that C3X can estimate.
resource "aws_s3_bucket_server_side_encryption_configuration" "assets" {
bucket = aws_s3_bucket.assets.id
rule {
apply_server_side_encryption_by_default {
sse_algorithm = "aws:kms"
kms_master_key_id = aws_kms_key.s3.arn
}
bucket_key_enabled = true
}
}Pricing dimensions
What you actually pay for when you provision aws_s3_bucket_server_side_encryption_configuration.
| Dimension | Unit | What's being charged |
|---|---|---|
| Encryption configuration | free | Setting default encryption is free, and SSE-S3 (AES256) with S3-managed keys adds no per-request cost. $0 |
| KMS requests (SSE-KMS) | per 10,000 requests | With aws:kms, each object write and read triggers a GenerateDataKey or Decrypt call. ~$0.03 per 10,000 requests |
| Customer-managed KMS key | per key-month | A customer-managed key used for SSE-KMS carries a flat monthly charge. ~$1/month per key |
Optimization tips
Common ways to reduce aws_s3_bucket_server_side_encryption_configuration cost without changing the workload.
Use SSE-S3 unless you need KMS
Avoids KMS request charges entirelySSE-S3 (AES256) encrypts objects for free with S3-managed keys. Reserve SSE-KMS for buckets that genuinely need customer-managed keys or a KMS audit trail, since KMS adds per-request cost.
Enable S3 Bucket Keys with SSE-KMS
Up to 99% off KMS request costSetting bucket_key_enabled caches a bucket-level data key so S3 makes far fewer KMS calls, cutting KMS request cost by up to 99% on high-traffic buckets.
Always turn default encryption on
Default encryption is free with SSE-S3 and closes a compliance gap. There is no cost reason to leave a bucket unencrypted.
FAQ
Does S3 bucket encryption cost money?
The setting is free, and SSE-S3 with AES256 adds no cost. You only pay when you choose SSE-KMS: each object write and read triggers a KMS request billed at about $0.03 per 10,000, plus roughly $1/month per customer-managed key.
Is SSE-KMS more expensive than SSE-S3?
Yes on busy buckets. SSE-KMS bills a KMS call per object read and write, so millions of GETs can cost more in KMS requests than storage. Enable S3 Bucket Keys to cut those calls by up to 99%, or use SSE-S3 if you do not need KMS.
How do I encrypt S3 objects cheaply?
Use SSE-S3 (AES256) for free encryption with S3-managed keys. If you need customer-managed keys, use SSE-KMS with bucket_key_enabled set so S3 makes far fewer billable KMS calls.
Related resources
Estimate this resource in your own Terraform
Free, open source, no API key. C3X parses your Terraform and shows line-item cost for every resource, including aws_s3_bucket_server_side_encryption_configuration.