Prevent RAM users from creating unencrypted disks-Elastic Compute Service(ECS)-阿里云帮助中心

Create a custom RAM policy that denies ECS disk creation unless encryption is enabled, enforcing enterprise security and compliance requirements.

Background

Disk data may include sensitive information such as business secrets, user data, or financial details. Without encryption, this data can be stolen or leaked during storage or transfer. Disk encryption prevents data theft from hypervisor or physical-layer attacks — even with physical access to the disk, the data remains unreadable.

Industries such as finance, healthcare, and government require sensitive data to be encrypted. Disk encryption helps enterprises meet compliance auditing requirements and demonstrate that their data storage meets security standards.

Procedure

This example enforces disk encryption for a RAM user named Alice when creating an ECS instance or a standalone disk.

Create a RAM user named Alice in the RAM console.

See Create a RAM user.

In the RAM console, create a custom policy named ecs-disk-encrypt-control. Enter the following policy content in the JSON editor.

Note

This policy denies ECS instance or standalone disk creation if disk encryption is disabled.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:RunInstances",
        "ecs:CreateInstance"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:IsDiskEncrypted": "*false*"
        }
      },
      "Effect": "Deny"
    },
    {
      "Action": [
        "ecs:RunInstances",
        "ecs:CreateInstance"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ecs:IsSystemDiskEncrypted": "false"
        }
      },
      "Effect": "Deny"
    },
    {
      "Action": "ecs:CreateDisk",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:IsDiskEncrypted": "*false*"
        }
      },
      "Effect": "Deny"
    }
  ]
}

Extended policy: Require master keys and prohibit unencrypted disks or disks encrypted with service keys

Alibaba Cloud Key Management Service (KMS) provides free service keys managed by Alibaba Cloud and shared across services. If a service key is leaked, multiple resources may be affected, and you cannot directly control service key lifecycles.

Use master keys for better security and control. Master keys provide separate encryption keys per resource, avoiding risks of shared keys. You have full control over master keys and can set custom key rotation policies. However, you are responsible for key management, including key storage, rotation, and backup.

If you purchased a KMS value-added service and require RAM users to use master keys, use the following policy:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "ecs:RunInstances",
        "ecs:CreateInstance"
      ],
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:IsDiskByokEncrypted": "*false*"
        }
      },
      "Effect": "Deny"
    },
    {
      "Action": [
        "ecs:RunInstances",
        "ecs:CreateInstance"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ecs:IsSystemDiskByokEncrypted": "false"
        }
      },
      "Effect": "Deny"
    },
    {
      "Action": "ecs:CreateDisk",
      "Resource": "*",
      "Condition": {
        "StringLike": {
          "ecs:IsDiskByokEncrypted": "*false*"
        }
      },
      "Effect": "Deny"
    }
  ]
}

Create another custom policy named ecs-admin. Enter the following policy content in the JSON editor.

Note

This policy grants ECS management permissions, including purchasing, managing, and viewing instances. This example targets an ECS administrator. Modify the policy as needed.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecs:*",
        "ecs-workbench:*",
        "vpc:CheckCanAllocateVpcPrivateIpAddress",
        "vpc:DescribeVpcs",
        "vpc:DescribeVSwitches",
        "bss:ModifyAgreementRecord",
        "bss:DescribeOrderList",
        "bss:DescribeOrderDetail",
        "bss:PayOrder",
        "bss:CancelOrder"
      ],
      "Resource": "*"
    }
  ]
}

In the RAM console, grant the RAM user Alice the following permissions.

Set Authorization Scope to Account, set Principal to Alice, and select policies ecs-disk-encrypt-control and ecs-admin. See Manage permissions for a RAM user.

Verify the result

Log on to the Alibaba Cloud Management Console as the RAM user Alice.

See Log on to the Alibaba Cloud Management Console as a RAM user.

Test 1: Create an ECS instance without disk encryption

Go to the instance purchase page.
Click the Custom Launch tab.
Configure the billing method, region, instance type, and image. Do not select Encrypt for System Disk or Data Disk. See Create an instance using the wizard.

In the Storage configuration section, set the system disk type to ESSD Entry with a capacity of 40 GiB, and select Release with Instance. Click Add Data Disk to add a data disk, select ESSD as the disk type, PL0 (Max IOPS per disk: 10,000) as the performance level, set the capacity to 40 GiB, and select Release with Instance.
Confirm the order. The creation fails and an error message appears.

Test 2: Create a standalone disk without disk encryption

Go to ECS console - Block Storage - Disks.
On the Disks tab, click Create Disk.
On the Create Disk page, configure disk parameters. Do not select Encrypt. See Create an empty data disk.

On the Create Disk page, set the disk type to Ultra Disk with a capacity of 40 GiB.
Confirm the order. The creation fails and an error message appears.

The error message indicates that you do not have permission to create an instance. Contact the primary account owner to grant the required permissions in the RAM console. Required permissions:
- ecs:RunInstances — required for creating pay-as-you-go instances
- ecs:CreateInstance — required for creating subscription instances
- bss:PayOrder — required for order payment