You can enable the cloud disk encryption feature when your business needs to encrypt data stored on cloud disk for security or compliance requirements. The cloud disk encryption capability effectively protects data privacy through the infrastructure provided by Tencent Cloud Key Management Service (KMS). Key Management
Tencent Cloud uses the industry-standard AES-256 algorithm to encrypt your cloud disk data with the data key provided by Tencent Cloud Key Management Service (KMS). When you use an encrypted cloud disk for the first time, the system automatically creates a customer master key (CMK) in the corresponding region of KMS specifically for cloud disk encryption. There is exactly one automatically created key, and it is stored in the Key Management Service protected by strict physical and logical security controls. In each region, a unique 256-bit data key (DK) is used to encrypt the cloud disk. Snapshots created through encrypted cloud disks and encrypted cloud disks created through encrypted snapshots are all associated with this DK. The DK is protected by the key management infrastructure provided by KMS, which effectively blocks unauthorized access. The DK of a cloud disk is used only in the memory of the host where the instance resides, and is not stored in any persistent medium (including the cloud disk itself) in a plaintext form.
How it Works
When you configure your cloud disk as encrypted, Tencent Cloud Block Storage(CBS) uses the unique data key (DK) provided by KMS to encrypt data and automatically decrypts it when reading data. The encryption and decryption process runs on the host machine where the CVM instance resides, and has almost no impact on the read/write performance of low-load cloud disks. However, it has a certain impact on the read/write performance of cloud disks in high-load I/O-intensive workloads. You can refer to Measuring Cloud Disk Performance to test cloud disk performance. Once the encrypted cloud disk is created and attached to the instance, the system encrypts the following data:
Static data in the cloud disk.
Data transmitted between the cloud disk and instance (data in the operating system of the instance is not encrypted).
All snapshots created through encrypted cloud disks.
Encryption Types
CBS currently supports two encryption types:
|
First-generation encryption (V1) | General-purpose S1-S4 General-purpose SA1 Memory-optimized M1-M4 Compute C1-C4 A small number of General-purpose S5/M5 and SA2/MA2 instances | Incompatible with instance types that support only second-generation encryption |
Second-generation encryption (V2) | General-purpose S5 and later-generation instance types General-purpose SA2 and later-generation instance types Memory-optimized M5 and later-generation instance types Compute C5 and later-generation instance types Most GPU instance types that support CBS | Incompatible with instance types that support only first-generation encryption |
Note:
When you create an encrypted cloud disk together with an instance, the system automatically selects the encryption type for the cloud disk based on the instance type. You do not need to specify it yourself.
When you create an encrypted cloud disk separately, we strongly recommend that you create and attach it to an existing instance. In this case, the encryption type is automatically selected based on the instance type, and you do not need to specify it. If you choose to create a cloud disk without attaching it to an instance, you must specify the encryption type yourself. After that, the cloud disk can only be attached to supported instance generations.
Limits
The cloud disk encryption feature is subject to the following limitations:
|
Regional restrictions | Cloud disk encryption is supported only in Beijing, Shanghai, Guangzhou, Hong Kong (China), Singapore, Seoul, Tokyo, Jakarta, and Frankfurt. |
Cloud disk limitations | All types of cloud disks can be encrypted, regardless of type of associated instance. Only cloud disks can be encrypted, not local disks. You can only encrypt data disks. System disks cannot be encrypted directly. To encrypt a system disk, you can copy an encrypted image by using the CopyEncryptedImage API and then create a CVM instance from the encrypted image. An existing non-encrypted cloud disk cannot be directly converted to an encrypted cloud disk. An encrypted cloud disk cannot be converted to a non-encrypted cloud disk. A first-generation encrypted cloud disk cannot be attached to an instance type that supports only second-generation encryption, and vice versa. |
Snapshots and images limitations | A snapshot generated by an existing non-encrypted disk cannot be directly converted to an encrypted snapshot. An encrypted snapshot cannot be converted to a non-encrypted snapshot. An image with an encrypted snapshot cannot be shared. The encrypted snapshot and images created by it cannot be replicated across regions. |
Description | To use the cloud disk encryption feature, you need to grant the CBS service role for calling your KMS service. The role name is CVM_QcsRole. |
Other Limitations | The cloud disk encryption feature relies on the KMS in the same region. If you have no other operation requests, you do not need to perform additional operations in the KMS console. When you use the cloud disk encryption feature for the first time, you must activate KMS as instructed on the page. Otherwise, you cannot purchase the encrypted cloud disk. You can query the CMK created specifically by the system for cloud disk encryption in KMS console, but you cannot specify, delete, or change the CMK. |
Billing
The cloud disk encryption feature does not incur additional fees, and neither do read/write operations on data in cloud disk. However, for management operations on encrypted cloud disk, KMS is used through API calls whether you perform these operations in the console or by using APIs. KMS usage incurs fees. For details on KMS billing, see Key Management Service Billing Overview. Management operations on an encrypted cloud disk include:
Creating an Encrypted Cloud Disk
Mounting Cloud Disks
Detaching Cloud Disks
Creating a Snapshot
Rolling Back a Snapshot
Note:
Make sure you have sufficient account balance, otherwise the operation will fail.
Creating an encrypted cloud disk
You can create an encrypted cloud disk through the following three methods:
1. Log in to the CBS console, select a region, and click Create. 2. In the Purchase data disk dialog box, select Enable disk encryption.
Note:
If you are using encrypted cloud disk in this region for the first time, you need to authorize the service role first to allow the CBS service to call Key Management Service (KMS) for data encryption and decryption. The operation steps are as follows:
1. After you select Enable Disk Encryption, the page displays a message stating that encryption relies on Key Management Service (KMS) and requires authorization in CAM. Click the CAM link.
2. Go to Roles > Service Authorization and confirm the following information:
Role name: CVM_QcsRole
Role type: Service role
Authorization policy: QcloudKMSAccessForCVMRole (allows CVM/CBS to access KMS across services)
3. Click Agree to authorize. This operation must be performed by a root account or a sub-account with CAM role management permissions.
4. After authorization is completed, return to the CBS purchase page and select the encryption option again to use it normally.
3. Select the cloud disk configuration based on your actual needs and click Ok.
4. Once you have purchased the cloud disk, you can view encrypted cloud disks that have already been created on the Cloud disk list page. The new encrypted cloud disk is in to be attached status, you can refer to Attaching Cloud Disks to attach the cloud disk to a CVM instance in the same availability zone. You can select an encrypted snapshot to create a cloud disk. The cloud disk created in this way is encrypted automatically. For more information, see Creating Cloud Disks Using Snapshots. You can create an encrypted cloud disk by using the CreateDisks API. The following two methods are supported. Configure Encrypt as true.
Specify a SnapshotId for the encrypted snapshot.
Viewing the Encryption Type of an Encrypted cloud disk
Viewing Encryption Type in the CBS Console
Viewing Encryption Type via the API
1. Log in to the CBS console and select the region where you want to view cloud disks. 2. In the cloud disk list, click the Set List Fields button on the right. In the Customize List Fields dialog box that appears, select Encryption and click OK.
3. The cloud disk list displays whether a cloud disk is encrypted and the encryption generation if it is.
You can use the DescribeDisks API to check whether a CBS is encrypted and its encryption generation. Check the Encrypt and EncryptType fields in the returned Disk data structure. Changing Data Encryption Status
If you need to convert existing data on a cloud disk from unencrypted to encrypted, use the rsync command on Linux or the robocopy command on Windows to copy data from an unencrypted disk to a newly created encrypted disk.
If you need to convert existing data on a cloud disk from encrypted to unencrypted, use the same command to copy data from an encrypted disk to a newly created unencrypted disk.