title: aws s3 | bucket key enabled
body: <p>S3 has recently announced &quot;bucket_key_enabled&quot; option to cache the kms key used to encrypt the bucket contents so that the number of calls to the kms server is reduced.</p>
  <p><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html" rel="nofollow noreferrer">https://docs.aws.amazon.com/AmazonS3/latest/dev/bucket-key.html</a></p>
  <p>So if that the bucket is configured with</p>
  <ul>
  <li>server side encryption enabled by default</li>
  <li>use a kms key &quot;key/arn1&quot; for the above</li>
  <li>by selecting &quot;enable bucket key&quot;, we are caching &quot;key/arn1&quot; so that each object in this bucket does not require a call to kms server (perhaps internally it has time-to-live etc but the crust is that, this key is cached and thus kms limit errors can be avoided)</li>
  </ul>
  <p>Given all that, what is the point of overriding kms key at object level and still having this &quot;bucket_key_enabled&quot; set?</p>
  <p>Eg :</p>
  <pre><code>bucket/       -&gt; kms1 &amp; bucket_key_enabled
  bucket/prefix1 -&gt; kms2 &amp; bucket_key_enabled
  </code></pre>
  <p>Does s3 actually cache the object-key to kms-key map?</p>
  <p>To give you the context, I currently have the application which publishes data to the following structure</p>
  <pre><code>bucket/user1 
  bucket/user2 
  </code></pre>
  <p>While publishing to these buckets, it explicitly passed kms key assigned per user for each object upload.</p>
  <pre><code>bucket/user1/obj1 with kms-user-1
  bucket/user1/obj2 with kms-user-1
  bucket/user1/obj3 with kms-user-1
  
  
  bucket/user2/obj1 with kms-user-2
  bucket/user2/obj2 with kms-user-2
  bucket/user2/obj3 with kms-user-2
  </code></pre>
  <p>if s3 is smart enough to reduce this to the following map,</p>
  <pre><code>bucket/user1 - kms-user-1
  bucket/user2 - kms-user-2
  </code></pre>
  <p>All I have to do is, upgrade the sdk library to latest version and add a <code>withBucketKeyEnabled(true)</code> to the putObjectRequest in the s3Client wrapper we have.</p>
  <p>Let me know how it works internally so that we can make use of this feature wisely.</p>