A media firm stores files in Amazon S3 buckets encrypted by AWS KMS. On a daily basis, millions of photos and video files are added to this bucket. The Accounts Team is observing huge costs due to encryption of files and is looking for your suggestion in reducing cost.
Which of the following can be configured to have a cost-effective encryption solution?

Answer options:

A.Configure server-side encryption with AWS KMS using imported keys.
B.Configure server-side encryption with AWS KMS using Amazon S3 Bucket Keys.
C.Configure server-side encryption with AWS KMS using AWS-managed CMK.
D.Configure server-side encryption with AWS KMS using Customer managed CMK.

Correct Answer: B
Amazon S3 bucket can be configured to use Amazon S3 Bucket Keys with SSE-KMS. With this, AWS KMS generates a single bucket-level key that can be used to generate unique data keys for all new objects that will be stored in the bucket. This avoids using individual AWS KMS data keys for each object in the bucket. For existing objects in the Amazon S3 bucket, the COPY command can be used to have encryption using the S3 bucket key. 
Options A, C & D are incorrect as there would not be any cost reduction while using these keys. For a large number of objects, irrespective of any of these keys used, each time Amazon S3 bucket will make a request to AWS KMS for each encrypted object.
For more information on AWS KMS with Amazon S3 bucket keys, refer to the following URL,
https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-key.html