AWS: Caching KMS data keys to reduce cost and latency
This post details how NICE Actimize reduced AWS Key Management Service (AWS KMS) costs by 77% by addressing cache stampedes in their event-driven, multi-tenant encryption system. It explains the cache stampede problem that arises in high-concurrency scenarios with envelope encryption and presents two solutions: the AWS-recommended hierarchical keyring pattern and a custom caching approach. These patterns are applicable to multi-tenant SaaS environments and high-throughput systems generating significant KMS API volume.
- →Cache stampede problem in high-concurrency encryption
- →AWS-recommended hierarchical keyring pattern
- →NICE Actimize's custom caching solution
Notes (3) ›
- Cache stampede problem in high-concurrency encryption
In high-throughput systems using envelope encryption for per-tenant data isolation, cache stampedes can occur when multiple threads simultaneously request encryption or decryption materials. This leads to redundant AWS KMS calls for generating data keys and unwrapping encrypted data keys, inflating costs and degrading performance. The AWS Encryption SDK's CachingCryptoMaterialsManager can exacerbate this issue without proper coordination mechanisms.
- AWS-recommended hierarchical keyring pattern
The hierarchical keyring pattern introduces an intermediate key hierarchy, typically using branch keys stored in a DynamoDB table. This acts as a shared cache layer, coordinating across instances. When a cache expires, only a single thread requests a refresh for the branch key, rather than all threads acting independently. This significantly reduces the number of calls to AWS KMS.
- NICE Actimize's custom caching solution
NICE Actimize implemented a custom caching approach tailored to their regulated financial services environment. While the specifics are not fully detailed in this excerpt, it represents an alternative to the AWS-recommended pattern for solving the cache stampede problem in multi-tenant SaaS platforms.
https://aws.amazon.com/blogs/security/caching-kms-data-keys-in-multi-thread-environments-per-tenant-encryption-for-event-driven-systems-at-scale/
Related releases
- Terraform AWS Provider v6.60.0 Adds New Resources and Fixes Bugs Terraform AWS Provider Releases ·
- Amazon S3 enhances access denied errors with specific policy ARNs AWS What's New ·
- OpenAI Daybreak Red and Blue Cyber Defense Models Now on Amazon Bedrock AWS What's New ·
- AppFolio Transforms Data Streaming with Amazon MSK Express Brokers AWS Big Data Blog ·
- AWS IAM Role Manager Automates Service Role Setup AWS What's New ·
- Amazon Quick Integrates Microsoft Purview for Data Loss Prevention AWS What's New ·