Description

Ensure every File Storage file system that holds sensitive data is encrypted with a customer-managed master encryption key from OCI Vault, instead of the default Oracle-managed key. This gives the organization control over the key's rotation, access, and lifecycle.

Rationale

Oracle-managed keys protect data at rest, but the organization cannot control who uses them or revoke access in an emergency. A customer-managed key lets you enforce your own rotation schedule, restrict key use with IAM policies, and make the data unreadable by disabling the key if needed.

Impact

  • Gives control over key rotation and access

  • Allows access to data to be revoked by disabling the key

  • Disabling or deleting the key makes the file system unreadable

Default Value

By default, file systems are encrypted with an Oracle-managed key.

Pre-Requisites

  • Permission to manage file systems and to use keys in the vault

  • A vault with a symmetric AES master encryption key

  • Make sure an IAM policy allows the storage service to use the key, for example: Allow service objectstorage-<region>, blockstorage, FssOc1Prod to use keys in compartment <vault-compartment>

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under File Storage select File systems. Choose the compartment and select the file system.

  3. Check the Encryption key value.

  4. If it shows Oracle-managed key, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Make sure an IAM policy allows the storage service to use the key, for example: Allow service objectstorage-<region>, blockstorage, FssOc1Prod to use keys in compartment <vault-compartment>.

  3. Open the navigation menu, select Storage, and under File Storage select File systems. Select the file system.

  4. Next to Encryption key, select Edit.

  5. Select Encrypt using customer-managed keys, choose the vault and key, and save.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the file system, select Edit next to Encryption key, select Encrypt using Oracle-managed keys, and save.

Reference