Manage your AWS KMS API Request and Amazon CloudWatch in Canada, Toronto, Calgary

Introduction

At the point when you outperform your AWS KMS API demand rate amounts, you get a mistake “You have surpassed the rate at which you may call KMS. Decrease the recurrence of your calls.” Such blunders can likewise be brought about by an expanded utilization of AWS administrations that scramble your information under keys oversaw in AWS KMS. For instance, on the off chance that you are utilizing Amazon Redshift Spectrum, you may experience this mistake – “HTTP reaction blunder code: 503 Message: SlowDown. It would be ideal if you decrease your solicitation rate for activities including AWS KMS.” Historically, so as to see how near a solicitation rate quantity you were, you needed to perform three errands: (I) send AWS CloudTrail occasions produced by AWS KMS to Amazon CloudWatch Logs; (ii) compose inquiries in Amazon CloudWatch Logs Insights to follow your API demand utilization; and (iii) present an AWS Support case to demand a standard increment. Presently, you can see your AWS KMS API utilization and solicitation quantity increments inside the AWS Service Quotas support itself without doing any exceptional arrangement

View your AWS KMS API utilization

Programming interface usage is the rate at which you are calling a specific API contrasted with that API’s solicitation rate share in your record. For AWS KMS, the default demand rate for cryptographic tasks utilizing symmetric keys is 10,000 solicitations for each second in 6 explicit AWS Regions*, accumulated over all mentioning customers in a record. AWS KMS totals your API demands each moment and sends it to CloudWatch, where it is devoured by AWS Service Quotas for you to see. Since quantity utilization is collected continuously, your powerful share would be 600,000 solicitations for every moment

Scenario

Envision that all the applications in your record utilizing AWS KMS by and large made 100,000 solicitations to the Decrypt API, 100,000 solicitations to the GenerateDataKey API, and 100,000 solicitations to the Encrypt API in a moment. AWS KMS sends a check of 300,000 solicitations to Amazon CloudWatch for that specific moment. Your use for that moment will be half of your share (300,000 partitioned by 600,000, which is 60 seconds times your standard of 10,000 solicitations for every second). Inside the Service Quotas support, you can see usage over a few time spans, from the latest hour as long as seven days.

here are the steps to view your AWS KMS API Utilization within Service Quotas:

1.Sign in to the AWS Management Console.

2.Snap on “Administrations” dropdown on the upper left corner and quest for “Administration Quotas” and select it from the dropdown.

3.Snap on the AWS Key Management Service (AWS KMS) tile on the Service Quotas dashboard.

4.Quest for “symmetric” and click on the connection for “Cryptographic activities (symmetric) demand rate”.

5.The Monitoring segment will show the consolidated use rate for the accompanying APIs – Decrypt, Encrypt, GenerateDataKey, GenerateDataKeyWithoutPlaintext, GenerateRandom, and ReEncrypt. All these APIs are assembled under the common “Cryptographic activities (symmetric) demand rate”.

6.Change the chart to see the use pattern longer than seven days by choosing “1w” from the upper right corner of the diagram.

Create a CloudWatch Alarm

In the previous section we described how you can view historical utilization of API request rates from the Monitoring section of the AWS Service Quotas console. What if you want to be alerted when you have reached a predetermined utilization percentage so you can request a quota increase before you begin to experience extended throttling?

Here are the steps to do so

1.Click on the API of your interest from the Service Quotas console. In this example, let’s select Cryptographic operations (symmetric) request rate.

2.In the Amazon CloudWatch alarms section (under the Monitoring section), click Create on the right hand corner.
From the Alarm threshold dropdown select “80% of applied quota value”.

3.Enter “80threshold” as the Alarm name and click the orange Create button on the right side.

4.Click on the “80threshold” link that now appears in the table. 5.A new browser window will appear that takes you to the Amazon CloudWatch console.

6.Click Edit on the top right corner.

7.Leave all the default values selected on the Specify metrics and condition page and click Next on the bottom right.

8.Click Add notification and select Create new topic under the Select an SNS topic section. Enter “SNS-Topic” as the topic name. Add your email address to receive notifications when the alarm is set. Click Create topic.

9.Click Update alarm.

10.Confirm your SNS subscription by clicking on View SNS Subscriptions.

11.Select your email address endpoint and click Request confirmation.

12.You will receive an email to confirm your subscription. Once you confirm the subscription, you are all set to receive email notifications on the new alarm.

Conclusion

We’ve investigated how to see your AWS KMS API demand utilization, how to include alerts the most basic things in your application’s utilization of AWS KMS, and how to demand amount increments. These things give perceivability and command over how your applications associate with AWS KMS.