A company plans to use AWS Key Management Service (AWS KMS) to protect data at rest and requires client-side encryption. Multiple test projects are causing a surge in AWS usage, with applications issuing many KMS requests per second for encryption. The company needs a solution that prevents throttling, improves key usage for client-side encryption, and is cost optimized. Which solution meets these requirements?

Implementing data key caching with the AWS Encryption SDK's local cache and a caching cryptographic materials manager directly addresses the requirements. This approach reduces the number of calls to KMS for data key generation, thereby preventing throttling, improving performance, and optimizing costs. The caching mechanism stores recently used data keys locally, allowing applications to encrypt and decrypt data without repeatedly contacting KMS for each operation. The other options are less effective. Using keyrings with the AWS Encryption SDK, whether individually or as multi-keyrings, is a method for managing keys but doesn't inherently reduce KMS calls or prevent throttling. While key rotation is a security best practice, it doesn't directly solve the issue of high KMS request volume or improve client-side encryption performance in the way caching does.