Block Volumes Encrypted with Customer-Managed Keys

01 Sign in to your Oracle Cloud Infrastructure (OCI) account.

02 Navigate to Block Storage console available at https://cloud.oracle.com/block-storage/.

03 In the left navigation panel, choose Block Volumes, and select an OCI compartment from the Compartment dropdown menu, to list the Block Volumes provisioned in that compartment.

04 Click on the name (link) of the Block Volume that you want to examine, listed in the Name column.

05 Select the Block volume information tab, and check the Encryption key attribute value, listed in the right column. If Encryption key is set to Oracle-managed key, encryption at rest using Customer-Managed Keys (CMKs) is not enabled for the selected Oracle Cloud Infrastructure (OCI) Block Volume.

06 Repeat steps no. 4 and 5 for each Block Volume created in the selected Oracle Cloud Infrastructure (OCI) compartment.

07 Repeat steps no. 3 – 6 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.

01 Run iam compartment list command (Windows/macOS/Linux) with output query filters to list the ID of each compartment available in your Oracle Cloud Infrastructure (OCI) account:

oci iam compartment list
	--all
	--include-root
	--query 'data[]."id"'

02 The command output should return the requested OCI compartment identifiers (OCIDs):

[
	"ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
	"ocid1.compartment.oc1..abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd"
]

03 Run bv volume list command (Windows/macOS/Linux) with the ID of the OCI compartment that you want to examine as the identifier parameter, the list the ID of each OCI Block Volume provisioned in the selected OCI compartment:

oci bv volume list
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--all
	--query 'data[]."id"'

04 The command output should return the requested volume IDs:

[
	"ocid1.volume.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
	"ocid1.volume.oc1.ap-sydney-1.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234"
]

05 Run bv volume get command (Windows/macOS/Linux) with the name of the OCI Block Volume that you want to examine as the identifier parameter and custom output filters to determine if encryption at rest using Customer-Managed Keys (CMKs) is enabled for the selected volume:

oci bv volume get
	--volume-id 'ocid1.volume.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--query 'data.{"kms-key-id":"kms-key-id"}'

06 The command output should return the ID of the Customer-Managed Key (CMK) configured for the selected volume:

{
	"kms-key-id": null
}

07 Repeat steps no. 5 and 6 for each Block Volume provisioned in the selected OCI compartment.

08 Repeat steps no. 3 – 7 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.

01 Sign in to your Oracle Cloud Infrastructure (OCI) account.

02 Navigate to Key Management & Secret Management console available at https://cloud.oracle.com/security/kms.

03 In the left navigation panel, choose Vault, and select the OCI compartment where you want to deploy the new Vault, from the Compartment dropdown menu.

04 Choose Create Vault and perform the following actions to create the OCI Vault that will store your new Customer-Managed Key (CMK):

1. For Create in Compartment, select the appropriate OCI compartment.
2. For Name, enter a unique name for the new Vault.
3. (Optional) Check the Make it a virtual private vault setting checkbox if you want a dedicated partition in a Hardware Security Module (HSM).
4. (Optional) Choose Show advanced options and use the Tag key and Tag value fields to improve resource management by adding tags.
5. Choose Create Vault to deploy your new OCI Vault.

05 Once the Vault deployment is complete, click on the name (link) of the new OCI Vault instance, listed in the Name column.

06 In the Resources navigation panel, select Master Encryption Keys, choose Create Key, and perform the following actions to create the Customer-Managed Key (CMK) required for Block Volume encryption:

1. For Create in Compartment, select the appropriate OCI compartment.
2. For Protection Mode, choose the suitable protection mode for your key. The protection mode indicates how the key persists and where cryptographic operations that use the key are performed. Choose HSM to store and process the key on a Hardware Security Module (recommended for use cases with stringent compliance requirements) or Software to store and process the key on a server (recommended for most use cases). For more details about key protection modes, see the OCI official documentation.
3. For Name, enter a unique name for the new encryption key.
4. For Key Shape: Algorithm and Key Shape: Length, choose AES (Symmetric key used for Encrypt and Decrypt) with 256 bits.
5. (Optional) Choose Show advanced options and use the Tag key and Tag value fields to add tags to organize your resource.
6. Choose Create Key to generate your new encryption key.

07 Once your new Customer-Managed Key (CMK) is available, navigate to Block Storage console available at https://cloud.oracle.com/block-storage/.

08 In the left navigation panel, choose Block Volumes, and select an OCI compartment from the Compartment dropdown menu, to list the Block Volumes provisioned in that compartment.

09 Click on the name (link) of the Block Volume that you want to configure, listed in the Name column.

10 Select the Block volume information tab and choose Assign next to Encryption key attribute value to assign your new CMK.

11 On the Assign master encryption key configuration panel, provide the following information:

1. For Vault Compartment, select the OCI compartment of the Vault created in step no. 4.
2. For Vault, select the name of the OCI Vault created in step no. 4.
3. For Master Encryption Key Compartment select the OCI compartment of the Customer-Managed Key created in step no. 6.
4. For Master Encryption Key select the name of the Customer-Managed Key created in step no. 6.
5. Choose Assign to apply the Customer-Managed Key (CMK) key to your OCI Block Volume.

12 Repeat steps no. 9 - 11 for each Block Volume that you want to encrypt with a Customer-Managed Key (CMK), available in the selected Oracle Cloud Infrastructure (OCI) compartment.

13 Repeat steps no. 2 – 12 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.

01 Run kms management vault create command (Windows/macOS/Linux) to create the OCI Vault that will store your new Customer-Managed Key (CMK):

oci kms management vault create
	--display-name 'cc-project5-oci-vault'
	--vault-type 'DEFAULT'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'

02 The command output should return the configuration information available for the new OCI Vault:

{
	"data": {
		"compartment-id": "ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
		"crypto-endpoint": null,
		"defined-tags": {},
		"display-name": "cc-project5-oci-vault",
		"external-key-manager-metadata-summary": null,
		"freeform-tags": {},
		"id": "ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234",
		"is-primary": true,
		"is-vault-replicable": null,
		"lifecycle-state": "CREATING",
		"management-endpoint": null,
		"replica-details": null,
		"restored-from-vault-id": null,
		"time-of-deletion": null,
		"vault-type": "DEFAULT",
		"wrappingkey-id": ""
	},
	"etag": "abcd1234abcd1234abcd1234abcd1234abcd1234"
}

03 Run kms management vault get command (Windows/macOS/Linux) to describe the management endpoint configured for the OCI Vault created in the previous steps:

oci kms management vault get
	--vault-id 'ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234'
	--query 'data."management-endpoint"'

04 The command output should return the URL of the management endpoint configured for the selected Vault:

"https://abcd1234abcda-management.kms.ap-sydney-1.oraclecloud.com"

05 Run kms management key create command (Windows/macOS/Linux) to create a new KMS Customer-Managed Key (CMK) for your OCI Vault. For --key-shape parameter, specify the key shape algorithm and length. For --protection-mode parameter, specify the suitable protection mode for your key. For the --endpoint parameter, specify the OCI Vault management endpoint returned in the previous step:

oci kms management key create
	--display-name 'cc-project5-oci-key'
	--key-shape '{"algorithm":"AES","length":32}'
	--protection-mode 'SOFTWARE'
	--endpoint 'https://abcd1234abcda-management.kms.ap-sydney-1.oraclecloud.com'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--query 'data."id"'

06 The command output should return the configuration information available for the new KMS key:

"ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd"

07 Run bv volume-kms-key update command (Windows/macOS/Linux) with the name of the OCI Block Volume that you want to configure as the identifier parameter, to enable encryption at rest with KMS Customer-Managed Keys (CMKs) for the selected volume. For the --kms-key-id parameter, specify the ID of your Customer-Managed Key, returned in the previous step:

oci bv volume-kms-key update
	--volume-id 'ocid1.volume.oc1.ap-sydney-1.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--kms-key-id 'ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'

08 The command output should return the ID of the OCI KMS key assigned to the selected volume:

{
	"data": {
		"kms-key-id": "ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd"
	},
	"etag": "abcd1234abcd1234abcdabcd1234abcd"
}

09 Repeat steps no. 7 and 8 for each Block Volume that you want to encrypt with a Customer-Managed Key (CMK), provisioned in the selected Oracle Cloud Infrastructure (OCI) compartment.

10 Repeat steps no. 1 – 9 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.