AWS bill line item
KMS-Requests
Billing for KMS API calls (encrypt, decrypt, generate-data-key, and similar) once you exceed the monthly free-tier request allotment.
KMS API request charge beyond the free tier
Verified against official AWS documentation last checked
Why it shows up
Workloads that read or write large numbers of individual objects or items with server-side encryption enabled can generate an enormous number of per-object KMS calls, since each object read/write can trigger its own key-generation or decrypt call.
Because the per-request price is tiny, this charge is easy to dismiss until request volume reaches millions per month. At that point, it becomes one of the largest and least-expected line items on the bill.
How to cut it
- Turn on bucket-level key reuse for server-side encryption. This can cut request volume dramatically by reusing a bucket-level data key instead of calling KMS per object.
- Cache data keys client-side where the SDK/library supports envelope-encryption caching, instead of calling the API per operation.
- Use detailed billing data to identify which caller, service, or key is generating the request volume before optimizing.
- Batch or reduce per-object encryption operations where the access pattern allows it.
How to read a usage type
KMS-Requests carries no region or direction token, so there's nothing to break down here.
Source
Source: AWS docs →Found KMS-Requests on your own bill?
Drop your Cost Explorer CSV into the AWS Bill Analyzer. It'll flag line items like this one on your own bill and link straight back to the fix.
Analyze your own bill →A bill read by hand goes stale tomorrow.
Reading one export line by line takes real work. CostMon reads the next one for you, every day, for every provider you connect.