Description

Ensure in-transit encryption is enabled for compute instances, so that data moving between the instance and its paravirtualized boot and block volumes is encrypted. This setting is shown as In-transit encryption under the instance's launch options and on each volume attachment.

Rationale

Data sent between an instance and its storage travels over the provider's internal network. Without in-transit encryption, this traffic could be read or changed if the path were compromised. Enabling it protects the confidentiality and integrity of data in transit, alongside the at-rest encryption that OCI always applies.

Impact

  • Encrypts data between instances and their volumes

  • Protects against interception on internal paths

  • Some attachments may need to be detached and reattached

Default Value

In-transit encryption is enabled by default for supported shapes and images when the instance is created, but it can be turned off.

Pre-Requisites

  • Permission to manage instances and volume attachments in the compartment

  • A maintenance window if volumes must be reattached

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. In the Instance information section, under Launch options, check that In-transit encryption shows Enabled.

  4. Open the Storage (or Attached block volumes) section and check that each paravirtualized attachment has in-transit encryption enabled.

  5. If it is disabled, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. Open the boot volume attachment, select Edit, enable Use in-transit encryption, and save.

  4. For each attached paravirtualized block volume, open the attachment's Actions menu, select Edit, enable Use in-transit encryption, and save.

  5. If Edit is not available for an attachment, detach the volume and reattach it with Use in-transit encryption selected.

  6. Alternatively, run: oci compute boot-volume-attachment update --boot-volume-attachment-id <attachment-ocid> --is-pv-encryption-in-transit-enabled true

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Compute, and select Instances. Choose the compartment and select the instance.

  3. Edit the attachment again, clear Use in-transit encryption, and save.

Reference