When your business requires encryption protection for data stored on cloud disks due to security or compliance requirements, you can enable the cloud disk encryption feature provided by Key Management Service (KMS) to effectively protect data privacy.
Key Management
The industry-standard AES-256 algorithm is used to encrypt your cloud disk data with a data key. When you use an encrypted cloud disk for the first time, the system automatically creates a customer master key (CMK) in KMS for the corresponding region, dedicated to cloud disk encryption. This automatically created key is unique and stored in the KMS protected by strict physical and logical security controls.
Encrypted cloud disks in each region use a unique 256-bit data key (DK) for encryption. Snapshots created from encrypted cloud disks and encrypted cloud disks created from these snapshots are all associated with this key. The key is protected by KMS, effectively preventing unauthorized access. The DK of cloud disk is only used in the memory of the instance's host and is never stored in plaintext on any persistent medium (including the cloud disk itself).
How It Works
When you set a cloud disk as an encrypted cloud disk, KMS encrypts the data and decrypts it automatically when reading it. The encryption and decryption process runs on the host where the CVM instance is located, with almost no impact on the read-write performance of the cloud disk. For how to test the performance of a cloud disk, see How to Measure the Performance of a Cloud Disk.
After an encrypted cloud disk is created and attached to an instance, the system encrypts the following data:
- Static data in the cloud disk.
- Data transmitted between the cloud disk and the instance (data in the instance's operating system is not encrypted).
- All snapshots created from the encrypted cloud disk.
Use Limits
The encryption feature for cloud disks has the following limitations:
| Limit Type | Description |
|---|---|
| Limitations on cloud disks | - Cloud disk encryption currently supports all cloud disk types and instance types. - Only the cloud disk can be encrypted, but not the local disk. - Only the data disk can be encrypted, but not the system disk. - The existing non-encrypted disk cannot be directly converted into an encrypted disk. - The encrypted cloud disk cannot be converted into a non-encrypted cloud disk. - After an encrypted cloud disk is expanded, it should be detached from the CVM and then attached again, so that the new capacity can be recognized. - Encrypted cloud disks cannot be attached to instances with local storage. |
| Limits on snapshot and image | - The snapshot generated by existing non-encrypted disk cannot be directly converted into an encrypted snapshot. - The encrypted snapshot cannot be converted into a non-encrypted snapshot. - The image with an encrypted snapshot cannot be shared. - The snapshot generated by existing non-encrypted disk cannot be directly converted into an encrypted snapshot. - Encrypted snapshots and images created by encrypted snapshots cannot be copied across regions. |
| Other limits | - The cloud disk encryption feature depends on the KMS in the same region. If you have no other operation requests, no additional operations are required in the KMS console. - When using the cloud disk encryption feature for the first time, you need to authorize and activate KMS according to the page prompts. Otherwise, you will not be able to purchase encrypted cloud disks. - The CMK specifically created by the system for cloud disk encryption can be queried through the KMS console, but it cannot be specified, deleted, or modified by users. |
Operation Fees
The CBS encryption feature and the CMK used do not incur additional fees, nor do read and write operations on the cloud disk data. However, when managing the encrypted cloud disk, whether through the console or API, KMS will be used as an API. This will count towards your KMS invocation count in that region. KMS is itself billed based on the number of invocations.
Management operations for encrypted cloud disks include:
- Create an encrypted cloud disk.
- Attach a cloud disk.
- Detach a cloud disk.
- Create a snapshot.
- Roll back snapshot.
Note:
Ensure that your account balance is sufficient, otherwise the operation will fail.
Creating an Encrypted Cloud Disk
You can create an encrypted cloud disk using the following three methods:
Creating an Encrypted Cloud Disk via the Console
Log in to the CBS console, select the corresponding region, and then click Create.
In the "Purchase Data Disk" dialog box, check the Encrypt option.
Note:
If this is your first time using encrypted cloud disks in this region, you need to authorize KMS first.
Select the CBS configuration as needed and click OK.
After the purchase is complete, you can view the created encrypted cloud disk on the CBS list page.
The newly created encrypted cloud disk is in the To be mounted status. To mount the cloud disk to the Cloud Virtual Machine in the same availability zone, see Mounting Cloud Disks.
Creating an Encrypted Cloud Disk via a Snapshot
As described in Creating a Cloud Disk via a Snapshot, select an encrypted snapshot to create an encrypted cloud disk that already contains relevant data.
Creating an Encrypted Cloud Disk via API
You can use the CreateDisks API to create an encrypted cloud disk in the following two ways:
- Specify the encryption option
Encrypttotrue. - Specify
SnapshotIdof the encrypted snapshot.
Convert Data Encryption Status
If you need to convert existing data on the cloud disk from non-encrypted to encrypted, it is recommended that you use the rsync command in Linux or the robocopy command in Windows to copy data from the non-encrypted cloud disk to the new encrypted cloud disk.
If you need to convert existing data on the cloud disk from encrypted to non-encrypted, it is recommended that you use the same command to copy data from the encrypted disk to a new non-encrypted disk.