使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post

KMS Signing performance with Asymmetric ECC_NIST_P256 key is slow

0

Hello All, I'm building a lambda service where I use the python boto3 client to sign data using a customer managed key in Amazon KMS. The key as my title suggests is an Asymmetric ECC_NIST_P256 key. The signing operation works just fine, but it seems to take 160ms repeatedly. This seems awfully slow to me, but I am somewhat new to this kind of signing, so I don't know how long it should take. I do know I'm going to hammer this and it's for a time sensitive operation. 160ms is over my time budget (shooting for 50ms). I can verify that the key and the lambda service are in the same availability zone. Any help in troubleshooting this, speeding it up, or aligning my expectations to what it's supposed to do would be much appreciated.

Thanks

  • kumo-hiyori
    8 個月前

    How are you measuring the latency? It's possible that you overlooked something during measurement, or delay is coming from other part of the API call. I suggest using AWS X-Ray to trace the Lambda function call. https://docs.aws.amazon.com/lambda/latest/dg/services-xray.html

  • numeracle_brett
    8 個月前

    I have print statements tightly around the signing operation and looking at timestamps. I also removed the signing operation and watched the overall script speed increase drastically. I'm pretty sure I'm measuring it right.

    I did switch to envelope encryption to bring my keys closer to the script and used libraries to perform my signing. This has brought my latency from about 250ms total to 25ms total. Wish I could use Amazon KMS tho, not sure why it's so slow.

主題
安全性、身分識別與合規無伺服器運算
標籤
AWS Key Management ServiceAWS Lambda
語言
English
numeracle_brett
已提問 8 個月前檢視次數 443 次
1 個回答
0

Hello numeracle_brett,

To troubleshoot further and dive deeper in regards to seeing 160 ms latency, we require details that are non-public information to troubleshoot. Could you please open a support case with AWS using the following link

In the support case could you please provide the following information below?

  • KMS key ID
  • Lambda ARN
  • Is this behavior occurring in specific region or in all regions?
  • Lambda code
  • Lambda CloudWatch logs
AWS
支援工程師
Calvin_K
已回答 8 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

回答問題指南

相關內容