Description

Ensure every block volume that holds sensitive data is encrypted with a customer-managed master encryption key from OCI Vault, instead of the default Oracle-managed key. This gives the organization control over the key's rotation, access, and lifecycle.

Rationale

Block volumes often store databases, application data, and backups. With a customer-managed key, you decide who can use the key, enforce your own rotation schedule, and can make the data unreadable by disabling the key if needed. This adds a strong layer of control on top of OCI's default at-rest encryption.

Impact

  • Gives control over key rotation and access

  • Allows access to data to be revoked by disabling the key

  • Disabling or deleting the key makes the volume unreadable

Default Value

By default, block volumes are encrypted with an Oracle-managed key.

Pre-Requisites

  • Permission to manage volumes and to use keys in the vault

  • A vault with a symmetric AES master encryption key

  • Make sure an IAM policy allows the storage service to use the key, for example: Allow service objectstorage-<region>, blockstorage, FssOc1Prod to use keys in compartment <vault-compartment>

Test Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the navigation menu, select Storage, and under Block Storage select Block volumes. Choose the compartment and select the block volume.

  3. Check the Encryption key value.

  4. If it shows Oracle-managed key, follow the implementation steps.

Implementation Steps

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Make sure an IAM policy allows the storage service to use the key, for example: Allow service objectstorage-<region>, blockstorage, FssOc1Prod to use keys in compartment <vault-compartment>.

  3. Open the navigation menu, select Storage, and under Block Storage select Block volumes. Select the block volume.

  4. Next to Encryption key, select Assign (or Edit).

  5. Choose the vault and master encryption key, and select Assign.

Backout Plan

  1. Sign in to the OCI Console at https://cloud.oracle.com.

  2. Open the block volume, select Unassign (or Edit) next to Encryption key, and return to the Oracle-managed key.

Reference