Price a KMS estate at $1 per key per month plus request charges, and show what envelope-encryption data key caching saves.
Envelope encryption means KMS never sees your data: it issues a data key, your client encrypts locally, and the wrapped data key travels with the object. The billing consequence is that the GenerateDataKey call count is objects divided by the cache reuse factor, not the object count — so a reuse factor of 500 cuts the encrypt-side request bill by 99.8%. KMS bills are almost always request-driven rather than key-driven, and the difference between a $180 month and a $72,000 month is one client library configured to fetch a fresh data key for every object.
Cloud Key Management
Monthly cost = keys × $1 + (GenerateDataKey calls + Decrypt calls) ÷ 10,000 × $0.03, where GenerateDataKey calls = objects encrypted ÷ objects per cached data key.
Envelope encryption saving
Caching saving = (objects encrypted + decrypts) ÷ 10,000 × price − actual request cost: what you avoid by not calling KMS once per object.
Monthly cost = keys × $1 + (GenerateDataKey calls + Decrypt calls) ÷ 10,000 × $0.03, where GenerateDataKey calls = objects encrypted ÷ objects per cached data key. Envelope encryption means KMS never sees your data: it issues a data key, your client encrypts locally, and the wrapped data key travels with the object. The billing consequence is that the GenerateDataKey call count is objects divided by the cache reuse factor, not the object count — so a reuse factor of 500 cuts the encrypt-side request bill by 99.8%.
KMS bills are almost always request-driven rather than key-driven, and the difference between a $180 month and a $72,000 month is one client library configured to fetch a fresh data key for every object.
This calculator takes 8 inputs: Customer-managed KMS keys, Price per key per month, Price per 10,000 requests, Objects encrypted per month, Objects encrypted per cached data key, Decrypt calls per month, Automatic key rotation period, Key versions retained per key. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Bound it by three limits at once: messages encrypted per key, bytes encrypted per key, and cache lifetime. The AWS Encryption SDK exposes all three; a few thousand messages, a few gigabytes and a few minutes is a common setting that keeps request cost negligible without letting one data key protect a whole day of traffic.
No. Automatic rotation creates a new backing key inside the same key ID, so the $1 per month is unchanged and old versions stay available for decryption. Manual rotation — creating a genuinely new key and re-pointing aliases — does add $1 per month per key you keep.