Caching KMS data keys in multi-thread environments: Per-tenant encryption for event-driven systems at scale
Brief
This post assumes familiarity with envelope encryption and the AWS Encryption SDK .
When your encryption system generates millions of duplicate API calls per hour, costs spiral and performance degrades. That’s exactly the challenge NICE Actimize faced while operating their global-scale, event-driven financial crime detection platform on Amazon Web Services (AWS) .
NICE Actimize, a leading provider of financial crime, risk, and compliance solutions, processes millions of encrypted messages daily across hundreds of tenants. By rethinking how they cache encryption keys, they reduced their AWS Key Management Service (AWS KMS) costs by 77% while maintaining strict security guarantees and per-tenant encryption isolation.
In this post, we explore the cache stampede problem that emerges when envelope encryption meets high-concurrency, multi-tenant architectures.