v0.7.4

Changes

S3 Bucket Keys

• Encrypted S3 buckets now use an S3 Bucket Key. Without one, S3 calls KMS for every object read and write; each call is billed (about $0.03 per 10,000 requests) and counts against the account's KMS request-rate quota, which every service shares, so a busy bucket could get other services' encryption calls throttled. With a Bucket Key, S3 asks KMS for a bucket-level key derived from the bucket's KMS key and reuses it, which AWS says can cut KMS request traffic by up to 99%. New buckets get it at creation, and an existing encrypted bucket gets one update on its next pass. Objects already in the bucket keep working. The KMS key itself, and the permissions the operator derives for consumers, are unchanged.

Upgrade notes

• With a Bucket Key, KMS sees the bucket ARN as the encryption context instead of each object's ARN. The operator's own grants have no condition on it, but a key policy or IAM policy of your own that conditions on the object ARN (kms:EncryptionContext:aws:s3:arn) would stop matching. CloudTrail also records the bucket ARN.
• There is no opt-out.
• No spec, CRD, chart or IAM changes.