# Ensure Object Storage bucket is encrypted with a Customer Managed Key (CMK)

- Source: https://support.icompaas.com/support/solutions/articles/a_1790698521988616-ensure-object-storage-bucket-is-encrypted-with-a-customer-managed-key-cmk
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Oracle Cloud](https://support.icompaas.com/support/solutions/c_1790697859097233) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790697878907807)
- Last updated: 2026-09-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every Object Storage bucket that holds sensitive data is encrypted with a customer-managed master encryption key from OCI Vault, instead of the default Oracle-managed key. This gives the organization control over the key's rotation, access, and lifecycle.

**Rationale**

Oracle-managed keys protect data at rest, but the organization cannot control who uses the key, when it is rotated, or disable it in an emergency. A customer-managed key lets you enforce your own rotation schedule, limit key use with IAM policies, and revoke access to the data by disabling the key.

**Impact**

-   Gives control over key rotation and access
    
-   Allows access to data to be revoked by disabling the key
    
-   Disabling or deleting the key makes the data unreadable
    

**Default Value**

By default, buckets are encrypted with an Oracle-managed key.

**Pre-Requisites**

-   Permission to manage buckets and to use keys in the vault
    
-   A vault with a symmetric AES master encryption key
    
-   Make sure an IAM policy allows the storage service to use the key, for example: Allow service objectstorage-<region>, blockstorage, FssOc1Prod to use keys in compartment <vault-compartment>
    

**Test Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Select the Bucket information tab and check the Encryption key value under Features.
    
4.  If it shows Oracle-managed key, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Make sure an IAM policy allows the storage service to use the key, for example: Allow service objectstorage-<region>, blockstorage, FssOc1Prod to use keys in compartment <vault-compartment>.
    
3.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
4.  Next to Encryption key, select Assign (or Edit).
    
5.  Select the vault and master encryption key, and select Assign.
    
6.  Confirm that the bucket now shows the customer-managed key.
    

**Backout Plan**

1.  Sign in to the OCI Console at [https://cloud.oracle.com](https://cloud.oracle.com/).
    
2.  Open the navigation menu, select Storage, and under Object Storage & Archive Storage select Buckets. Choose the compartment and select the bucket.
    
3.  Next to Encryption key, select Unassign (or Edit) and return to the Oracle-managed key.
    

**Reference**

-   [https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/encryption.htm](https://docs.oracle.com/en-us/iaas/Content/Object/Tasks/encryption.htm)
    
-   [https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keyoverview.htm](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Concepts/keyoverview.htm)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.