You can enable Account-level Default Encryption for Elastic Block Storage (EBS) on a per-region basis. After this feature is enabled, all new disks, copied snapshots, and copied images that you create in the specified region are automatically encrypted. This eliminates the need to specify encryption parameters for each resource. This feature also helps security teams and enterprise accounts ensure that all new disks meet security requirements and simplifies managing encrypted resources.
Limitations
The Account-level Default Encryption feature has the following limitations:
This feature is available only to specific users. To request access, submit a ticket.
A RAM user can configure Account-level Default Encryption only after an Alibaba Cloud account grants them the AliyunECSFullAccess policy. For more information, see Manage RAM permissions.
Before you enable Account-level Default Encryption, you must activate Key Management Service (KMS). For more information, see Purchase and enable a KMS instance.
After you enable Account-level Default Encryption:
This feature applies only to new disks and does not affect existing disks.
You can no longer create unencrypted disks or use the Copy feature to create unencrypted copies of snapshots and images.
You cannot create standard SSDs, ultra disks, or basic disks from any snapshot.
Configure account-level default encryption
Enable account-level default encryption
You must configure Account-level Default Encryption for each region. Once enabled, all new disks and all copies of snapshots and images in that region are automatically encrypted.
Console
Log on to the ECS console.
On the Overview page, in the Common Features section on the right, click Configure Encryption Settings.
Click Add Region, select a region and a default encryption key, and then click OK.
NoteFor the default encryption key, you can select either a service key (alias/acs/ecs) or a customer master key (CMK) that you previously created in KMS. For more information about encryption keys, see Encrypt a disk. The use of CMKs is subject to region and permission restrictions. For more information, see Encrypt a disk.
Create an encrypted disk. For more information, see Create an empty data disk.
In the Disk Parameters section, the Encrypt option is selected by default and cannot be modified. The disk is automatically encrypted using the configured default key. You can change the encryption key in the Encryption Key drop-down list.
NoteIf you create a disk from a snapshot, you can create only ESSD, ESSD Entry, or ESSD AutoPL disks.
API
Call the EnableDiskEncryptionByDefault operation to enable Account-level Default Encryption.
Disable account-level default encryption
You can disable Account-level Default Encryption for a region at any time. Once disabled, you must manually enable encryption to create an encrypted disk. For more information, see Create an encrypted disk.
Console
Log on to the ECS console.
On the Overview page, in the Common Features section on the right, click Configure Encryption Settings.
In the row that contains the target region, click the
icon to disable the default encryption feature.
API
Call the DisableDiskEncryptionByDefault operation to disable the default encryption feature for the target region.
Encryption results
Disks, snapshots, and images can be encrypted in one of two ways:
Enable encryption and specify an encryption key when you create a disk, snapshot, or image.
After you enable Account-level Default Encryption for EBS, new disks and copies of snapshots and images are automatically encrypted using the configured default key. If you also specify an encryption key, the specified key takes precedence.
NoteIf multiple keys can be applied to a disk, snapshot, or image, the key with the highest priority is used. Priority: specified key > source snapshot key (when you create a disk from a snapshot or copy a snapshot) > configured default key > service key (alias/acs/ecs).
Disk encryption results
Encryption specified | Disk source | Default encryption disabled | Default encryption enabled | ||
Default (no key specified) | Custom (key specified) | Default (no key specified) | Custom (key specified) | ||
No (The Encrypt option is not selected when you create the disk.) | New (empty) disk | Not encrypted | N/A | Encrypted with the configured default key | N/A |
From an unencrypted snapshot or image | Not encrypted | Encrypted with the configured default key | |||
From an encrypted snapshot or image | Encrypted with the source snapshot or image key | Encrypted with the source snapshot or image key | |||
From a shared unencrypted snapshot or image | Not encrypted | Encrypted with the configured default key | |||
From a shared encrypted snapshot or image (Only encrypted snapshots that use BYOK keys can be shared. The key must be changed during the sharing process.) | Encrypted with the service key | Encrypted with the configured default key | |||
Yes (When creating a disk, select Encrypt) | New (empty) disk | Encrypted with the service key | Encrypted with the specified key | Encrypted with the configured default key | Encrypted with the specified key |
From an unencrypted snapshot or image | Encrypted with the service key | Encrypted with the specified key | Encrypted with the configured default key | Encrypted with the specified key | |
From an encrypted snapshot or image | Encrypted with the source snapshot key | Encrypted with the specified key | Encrypted with the source snapshot key | Encrypted with the specified key | |
From a shared unencrypted snapshot or image | Encrypted with the service key | Encrypted with the specified key | Encrypted with the configured default key | Encrypted with the specified key | |
From a shared encrypted snapshot or image (Only encrypted snapshots that use BYOK keys can be shared. The key must be changed during the sharing process.) | Encrypted with the service key | Encrypted with the specified key | Encrypted with the configured default key | Encrypted with the specified key | |
Snapshot encryption results
Encryption specified | Snapshot source | Default encryption disabled | Default encryption enabled | ||
Default (no key specified) | Custom (key specified) | Default (no key specified) | Custom (key specified) | ||
N/A (During snapshot creation) | From an unencrypted disk | Not encrypted | N/A | Not encrypted | N/A |
From an encrypted disk | Encrypted with the source disk key | Encrypted with the source disk key | |||
No (To copy the snapshot, select Copy) | Unencrypted snapshot with cross-region copy (The Copy feature supports only cross-region copy.) | Not encrypted | Encrypted with the default key of the destination region | ||
Encrypted snapshot with cross-region copy (The Copy feature supports only cross-region copy.) | N/A (Encrypted snapshots can be copied only using the Copy and Encrypt feature.) | N/A (Encrypted snapshots can be copied only using the Copy and Encrypt feature.) | |||
Shared unencrypted snapshot with cross-region copy | Not encrypted | Encrypted with the default key of the destination region | |||
Shared encrypted snapshot with cross-region copy | N/A (Encrypted snapshots can be copied only using the Copy and Encrypt feature.) | N/A (Encrypted snapshots can be copied only using the Copy and Encrypt feature.) | |||
Yes (When copying a snapshot, select Copy and Encrypt) | A snapshot copied and encrypted within the same region | Encrypted with the service key of the current region | Encrypted with the specified key | Encrypted with the configured default key | Encrypted with the specified key |
A snapshot copied and encrypted across regions | Encrypted with the service key of the destination region | Encrypted with the default key of the destination region | |||
Image encryption results
Encryption specified | Image source | Default encryption disabled | Default encryption enabled | ||
Default (no key specified) | Custom (key specified) | Default (no key specified) | Custom (key specified) | ||
N/A (During image creation) | From an ECS instance with unencrypted disks | Not encrypted | N/A | Not encrypted | N/A |
From an ECS instance with encrypted disks | Encrypted with the keys of the source disks | Encrypted with the keys of the source disks | |||
No (To copy an image, select Copy) | Unencrypted image with cross-region copy (The Copy feature supports only cross-region copy.) | Not encrypted | Encrypted with the default key of the destination region | ||
Encrypted image with cross-region copy (The Copy feature supports only cross-region copy.) | N/A (Encrypted images can be copied only using the Copy and Encrypt feature.) | N/A (Encrypted images can be copied only using the Copy and Encrypt feature.) | |||
Shared unencrypted image with cross-region copy | Not encrypted | Encrypted with the default key of the destination region | |||
Shared encrypted image with cross-region copy | N/A (Encrypted images can be copied only using the Copy and Encrypt feature.) | N/A (Encrypted images can be copied only using the Copy and Encrypt feature.) | |||
Yes (When copying an image, select Copy and Encrypt.) | An image copied and encrypted within the same region | Encrypted with the service key of the current region | Encrypted with the specified key | Encrypted with the configured default key | Encrypted with the specified key |
An image copied and encrypted across regions | Encrypted with the service key of the destination region | Encrypted with the default key of the destination region | |||
Related operations
You can call the following API operations to perform related tasks:
Modify the default encryption key: ModifyDiskDefaultKMSKeyId or ResetDiskDefaultKMSKeyId.
Query the default encryption key: DescribeDiskDefaultKMSKeyId.
Query the status of the Account-level Default Encryption feature: DescribeDiskEncryptionByDefaultStatus.