Voxel Media hosts a data lake with billions of small objects in Amazon S3 using SSE-KMS with a customer managed CMK. Recently, KMS request charges spiked and occasional throttling occurred during heavy PUT/GET bursts. They must retain SSE-KMS. What is the most effective change to reduce KMS requests and costs without altering compliance posture?

Enabling S3 Bucket Keys is the most effective solution because it allows S3 to generate a unique data key for each object using a bucket-level key derived from the CMK, rather than requesting a new data key from KMS for every single object operation. This significantly reduces the number of direct KMS API calls, thereby lowering costs and mitigating throttling. Switching to SSE-S3 is not viable as it changes the encryption mechanism and compliance posture (customer-managed CMK is required). Requesting a higher KMS quota addresses throttling but does not reduce the number of requests or associated costs. Client-side encryption with KMS-managed keys would still involve KMS calls for each object's data key, potentially increasing complexity and not necessarily reducing KMS usage per object in a way that solves the core problem of high request volume.