aws-kms

KMS keys cost $1/month each — the easy number. The hidden bill is request volume at $0.03 per 10K calls, multi-region replicas that each bill $1/month independently, and asymmetric operations at 5× the symmetric rate. An S3 bucket with 100M SSE-KMS objects and an active read pattern can generate thousands per month in KMS requests alone.

Most KMS guides stop at "enable encryption." The architecture decision that actually bites is the key boundary: split one CMK into 3,200 per-tenant keys and you pay ~$3,200/mo in key storage alone while still sharing a single 10,000 req/s symmetric quota. Here is the decision matrix, the throttle math, and the encryption-context pattern that gives per-tenant isolation without per-tenant keys.