Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Key management

The following sections provide information about working with keys managed in Amazon Key Management Service (Amazon KMS). For more about

Estimating Amazon KMS costs

To predict costs and better understand your Amazon bill, you might want to know how often Amazon SNS uses your Amazon KMS key.

To calculate the number of API requests (R) per topic, use the following formula:

R = B / D * (2 * P)

B is the billing period (in seconds).

D is the data key reuse period (in seconds—Amazon SNS reuses a data key for up to 5 minutes).

P is the number of publishing principals that send to the Amazon SNS topic.

The following are example calculations. For exact pricing information, see Amazon Key Management Service Pricing.

Example 1: Calculating the number of Amazon KMS API calls for 1 publisher and 1 topic

This example assumes the following:

2,678,400 / 300 * (2 * 1) = 17,856

Example 2: Calculating the number of Amazon KMS API calls for multiple publishers and 2 topics

This example assumes the following:

(2,419,200 / 300 * (2 * 3)) + (2,419,200 / 300 * (2 * 5)) = 129,024

Configuring Amazon KMS permissions

Before you can use SSE, you must configure Amazon KMS key policies to allow encryption of topics and encryption and decryption of messages. For examples and more information about Amazon KMS permissions, see Amazon KMS API Permissions: Actions and Resources Reference in the Amazon Key Management Service Developer Guide. For details on how to set up an Amazon SNS topic with server-side encryption, see Set up an Amazon SNS topic with server-side encryption.

You must also ensure that the key policies of the Amazon KMS key allow the necessary permissions. To do this, name the principals that produce and consume encrypted messages in Amazon SNS as users in the KMS key policy.

Alternatively, you can specify the required Amazon KMS actions and KMS ARN in an IAM policy assigned to the principals that publish and subscribe to receive encrypted messages in Amazon SNS. For more information, see Managing Access to Amazon KMS in the Amazon Key Management Service Developer Guide.

If selecting a customer-managed key for your Amazon SNS topic and you are using aliases to control access to KMS keys using IAM policies or KMS key policies with the condition key kms:ResourceAliases, ensure that the customer-managed key that is selected also has an alias associated. For more information on using alias to control access to KMS keys, see Using aliases to control access to KMS keys in the Amazon Key Management Service Developer Guide.

Allow a user to send messages to a topic with SSE

The publisher must have the kms:GenerateDataKey* and kms:Decrypt permissions for the Amazon KMS key.

{
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "kms:GenerateDataKey*",
      "kms:Decrypt"
    ],
    "Resource": "arn:aws-cn:kms:us-east-2:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"
  }, {
    "Effect": "Allow",
    "Action": [
      "sns:Publish"
    ],
    "Resource": "arn:aws-cn:sns:*:123456789012:MyTopic"
  }]
}

Enable compatibility between event sources from Amazon services and encrypted topics

Several Amazon services publish events to Amazon SNS topics. To allow these event sources to work with encrypted topics, you must perform the following steps.

Amazon KMS errors

When you work with Amazon SNS and Amazon KMS, you might encounter errors. The following list describes the errors and possible troubleshooting solutions.