AWS solutions documentation change
Summary
Updated cost estimates and added KMS cost optimization section detailing caching techniques (S3 Bucket Keys, SQS data key reuse, Secrets Manager caching) that reduce KMS API calls by ~70%
Security assessment
The changes primarily focus on cost optimization through cryptographic efficiency improvements. While KMS caching techniques (S3 Bucket Keys, SQS key reuse, Secrets Manager caching) are security features, the documentation update doesn't address a specific vulnerability or incident. The changes demonstrate security best practices for efficient key management but lack evidence of remediating a security flaw.
Diff
diff --git a/solutions/latest/automated-security-response-on-aws/cost.md b/solutions/latest/automated-security-response-on-aws/cost.md index 1f5fad3ea..4fd821eae 100644 --- a//solutions/latest/automated-security-response-on-aws/cost.md +++ b//solutions/latest/automated-security-response-on-aws/cost.md @@ -5 +5 @@ -Sample cost tablePricing examples (monthly)Additional cost for optional features +Sample cost tableKMS cost optimizationPricing examples (monthly)Additional cost for optional features @@ -13 +13 @@ As of this revision, the estimated monthly costs are: - * Small deployment (10 accounts, 1 region - US East/N. Virginia): Approximately $20.73 for 300 remediations/month + * Small deployment (10 accounts, 1 region - US East/N. Virginia): Approximately $14.70 for 300 remediations/month @@ -15 +15 @@ As of this revision, the estimated monthly costs are: - * Medium deployment (100 accounts, 1 region - US East/N. Virginia): Approximately $136.57 for 3,000 remediations/month + * Medium deployment (100 accounts, 1 region - US East/N. Virginia): Approximately $106.40 for 3,000 remediations/month @@ -17 +17 @@ As of this revision, the estimated monthly costs are: - * Large deployment (1,000 accounts, 10 regions): Approximately $10,460.80 for 30,000 remediations/month + * Large deployment (1,000 accounts, 10 regions): Approximately $7,360.00 for 30,000 remediations/month @@ -67 +67 @@ Service | Free Tier | Pricing [USD] -[AWS Key Management Service](https://aws.amazon.com/kms/pricing/) | 20,000 requests/month | $1.00 per 1 KMS key. For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. +[AWS Key Management Service](https://aws.amazon.com/kms/pricing/) | 20,000 requests/month | $1.00 per 1 KMS key. $0.03 per 10,000 API requests. For KMS keys that you rotate automatically or on demand, the first and second rotation of the key adds $1/month (prorated hourly) in cost. **Note: This solution includes KMS caching optimizations (S3 Bucket Keys, 60-minute SQS data key reuse, 5-minute Secrets Manager caching) that reduce KMS API calls by approximately 70%.** @@ -72,0 +73,15 @@ Service | Free Tier | Pricing [USD] +## KMS cost optimization + +Since **version 3.1.0** , this solution includes KMS caching optimizations that reduce cryptographic operation costs by approximately 70% + + * **S3 Bucket Keys** : Reduces KMS GenerateDataKey calls for S3 encryption operations + + * **SQS Data Key Reuse** : 60-minute cache period for message encryption + + * **Secrets Manager Caching** : 5-minute TTL in Lambda functions + + + + +**Performance Impact** : These optimizations improve latency by 10-15ms for S3 operations and full workflows while reducing costs, with no throughput degradation. + @@ -87 +102 @@ Service | Free Tier | Pricing [USD] - * Total cost $20.73 per month + * Total cost $14.70 per month @@ -101 +116 @@ Amazon EventBridge rules | No charge for rules | $0 -AWS Key Management Service | 1 key * 10 accounts * 1 Region * $1 = $10 (Encrypt/Decrypt API requests) (300 remediations * 2 requests) + (5,000 findings * 4 requests) = 20,600 requests $0.03 per 10,000 requests ⇒ $0.03 * (20,600 / 10,000) = $0.06 | $10.06 +AWS Key Management Service | 1 key * 10 accounts * 1 Region * $1 = $10 (Encrypt/Decrypt API requests) (300 remediations * 2 requests) + (5,000 findings * 4 requests) = 20,600 requests With KMS caching: 20,600 * 0.30 = 6,180 requests $0.03 per 10,000 requests ⇒ $0.03 * (6,180 / 10,000) = $0.02 | $10.02 @@ -109 +124 @@ Amazon CloudWatch - X-Ray Traces | 300 remediations * 7 requests = 2,100 Lambda -**Total** | | **$20.73** +**Total** | | **$14.70** @@ -164 +179 @@ Amazon API Gateway | $3.50 per million REST API calls | $3.50 - * Total cost $136.57 per month + * Total cost $106.40 per month @@ -178 +193 @@ Amazon EventBridge rules | No charge for rules | $0 -AWS Key Management Service | 1 key * 100 accounts * 1 Region * $1 = $100 (Encrypt/Decrypt API requests) (3,000 remediations * 2 requests) + (50,000 findings * 4 requests) = 206,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (206,000 / 10,000) = $0.618 | $100.618 +AWS Key Management Service | 1 key * 100 accounts * 1 Region * $1 = $100 (Encrypt/Decrypt API requests) (3,000 remediations * 2 requests) + (50,000 findings * 4 requests) = 206,000 requests With KMS caching: 206,000 * 0.30 = 61,800 requests $0.03 per 10,000 requests ⇒ $0.03 * (61,800 / 10,000) = $0.185 | $100.185 @@ -186 +201 @@ Amazon CloudWatch - X-Ray Traces | 3,000 remediations * 7 requests = 2,100 Lamb -**Total** | | **$136.57** +**Total** | | **$106.40** @@ -200 +215 @@ Amazon CloudWatch - X-Ray Traces | 3,000 remediations * 7 requests = 2,100 Lamb - * Total cost $10,460.80 per month + * Total cost $7,360.00 per month @@ -214 +229 @@ Amazon EventBridge rules | No charge for rules | $0 -AWS Key Management Service | (1 key) $1 * 1,000 accounts * 10 Region = $10,000 (Encrypt/Decrypt API requests) (30,000 remediations * 2 requests) + (5,000,000 findings * 4 requests) = 20,060,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (20,060,000 / 10,000) = $60.18 | $10,060.18 +AWS Key Management Service | (1 key) $1 * 1,000 accounts * 10 Region = $10,000 (Encrypt/Decrypt API requests) (30,000 remediations * 2 requests) + (5,000,000 findings * 4 requests) = 20,060,000 requests With KMS caching: 20,060,000 * 0.30 = 6,018,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (6,018,000 / 10,000) = $18.05 | $10,018.05 @@ -222 +237 @@ Amazon CloudWatch - X-Ray Traces | 30,000 remediations * 7 requests = 210,000 L -**Total** | | **$10,460.80** +**Total** | | **$7,360.00** @@ -236 +251 @@ Amazon CloudWatch - X-Ray Traces | 30,000 remediations * 7 requests = 210,000 L - * Total cost $10,480.90 per month + * Total cost $7,380.10 per month @@ -250 +265 @@ Amazon EventBridge rules | No charge for rules | $0 -AWS Key Management Service | (1 key) $1 * 1,000 accounts * 10 Region = $10,000 (Encrypt/Decrypt API requests) (30,000 remediations * 2 requests) + (5,000,000 findings * 4 requests) = 20,060,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (20,060,000 / 10,000) = $60.18 | $10,060.18 +AWS Key Management Service | (1 key) $1 * 1,000 accounts * 10 Region = $10,000 (Encrypt/Decrypt API requests) (30,000 remediations * 2 requests) + (5,000,000 findings * 4 requests) = 20,060,000 requests With KMS caching: 20,060,000 * 0.30 = 6,018,000 requests $0.03 per 10,000 requests ⇒ $0.03 * (6,018,000 / 10,000) = $18.05 | $10,018.05 @@ -263 +278 @@ Amazon API Gateway | $3.50 per million REST API calls | $3.50 -**Total** | | **$10,480.90** +**Total** | | **$7,380.10**