LAB 26 ‐ Data encryption at rest in OCI - DevWithNehaCloud/Oracle-Cloud-Infrastructure-wiki GitHub Wiki

Data Encryption at Rest in OCI

What is Data Encryption at Rest?

Data Encryption at Rest means:

Data stored inside storage services is encrypted automatically.
If someone gets physical access to storage, they still cannot read the data without the encryption key.

In OCI, encryption protects:

Block Volumes
Boot Volumes
Object Storage
File Storage
Databases

Simple Definition

Encryption at Rest means:

Converting stored data into unreadable encrypted format to protect it from unauthorized access.

Real-Life Example

Suppose a company stores:

Customer data
Bank details
Employee records

inside OCI storage.

If storage is hacked or disks are stolen:

Normal data can be read directly.
Encrypted data cannot be read without the encryption key.

That is why encryption at rest is important.

How OCI Encryption at Rest Works

Original Data
      ↓
Encryption Key Encrypts Data
      ↓
Encrypted Data Stored in Storage
      ↓
Authorized User Decrypts Data

Types of Encryption Keys Used

1. Oracle Managed Key

OCI automatically manages keys.
Easy to use.
Default option.

Example

OCI automatically encrypts Block Volume using Oracle-managed key.

2. Customer Managed Key

Customer creates and controls the key using OCI Vault.
More security and control.
Used in enterprise environments.

Example

Company stores its own encryption key in OCI Vault and uses it for storage encryption.

Why Encryption at Rest is Important

Protects sensitive data
Prevents unauthorized access
Meets compliance requirements
Improves cloud security
Secures backup data

OCI Services Supporting Encryption at Rest

OCI Service	Encryption Support
Block Volume	Yes
Boot Volume	Yes
Object Storage	Yes
File Storage	Yes
Database Services	Yes

Real Scenario Example

Banking Application

A banking company stores:

Customer account details
Transaction records
ATM PIN information

inside OCI Database and Block Storage.

Using Encryption at Rest:

Data remains encrypted in storage.
Even storage administrators cannot directly read raw data.

OCI Vault: Keys vs Secrets

Overview

In OCI Vault, there are two major components:

Keys (Master Encryption Keys)
Secrets

Both are security-related services, but their purpose is completely different.

1. Keys (Customer-Managed Keys)

Keys are used for encryption.

These keys are commonly assigned to:

Boot Volumes
Block Volumes
Object Storage Buckets
Databases
File Storage

When a custom key is assigned, OCI uses that key instead of the Oracle-managed key.

Example

Create a key in OCI Vault:

project-key

Assign it to:

Boot Volume
Block Volume
Object Storage Bucket

Now OCI encrypts the resource using your custom Vault key.

Primary Purpose

Data Encryption at Rest

Used for:

Disk encryption
Storage encryption
Bucket encryption
Database encryption

2. Secrets

Secrets are used to securely store sensitive values.

Secrets can store:

Passwords
API Keys
Tokens
SSH Private Keys
Certificates
Database Credentials

Example

Application team has:

DB Username: admin
DB Password: MyPassword123

Storing passwords directly inside application code is a security risk.

Instead, they store the password inside OCI Vault Secrets.

Difference Between Keys and Secrets

Feature	Keys	Secrets
Purpose	Encrypt data	Store sensitive values
Used For	Storage encryption	Passwords, API tokens
Used By	OCI Services	Applications
Example	Bucket encryption	DB password
Data Stored	Encryption key material	Sensitive information
Main Function	Encryption/Decryption	Secure secret storage

Real-World Examples

Case 1 — Storage Encryption

Requirement:

"The bucket must use a customer-managed encryption key."

Solution

Create Vault Key
Assign key to Object Storage Bucket

✅ Use KEY

Case 2 — Application Password Storage

Requirement:

"Store database password securely."

Solution

Create Vault Secret
Store password inside secret

✅ Use SECRET

How Secrets Work

Secrets themselves are encrypted using Vault Keys.

Architecture:

Secret → Encrypted using Vault Key

This means:

Key provides encryption
Secret stores sensitive content

OCI Vault Architecture

Vault
 ├── Keys
 │     ├── bucket-key
 │     ├── boot-volume-key
 │
 └── Secrets
       ├── db-password
       ├── api-token
       ├── ssh-private-key

How to Create a Secret in OCI

Steps

Open OCI Console
Navigate to:
```
Identity & Security → Vault
```
Open your Vault
Click on:
```
Go to Secrets Management
    ```
```

Click:
```
Create Secret
```

Secret Configuration

Secret Name

prod-db-password

Encryption Key

Select the Vault Key that will encrypt the secret.

Secret Content

MyPassword123

Application Team Usage

Use Vault Key When:

Encrypting Boot Volumes
Encrypting Block Volumes
Encrypting Buckets
Encrypting OCI resources

Use Vault Secret When:

Storing passwords
Storing API keys
Storing tokens
Storing SSH keys
Storing certificates

DevOps / Application Example

A Kubernetes application needs:

Database password
API token

Instead of hardcoding credentials in application code:

Store credentials in OCI Vault Secrets
Application fetches secrets securely using OCI SDK/CLI/API

Interview Explanation

OCI Vault Keys are used for encryption of OCI resources, while OCI Vault Secrets are used to securely store sensitive information such as passwords, API keys, and tokens.

Short Summary

Component	Purpose
Vault Key	Encrypt OCI resources
Vault Secret	Store confidential data securely

Encryption at Rest vs Encryption in Transit

Overview

Encryption protects data from unauthorized access.

There are two major types of encryption:

Encryption at Rest
Encryption in Transit

1. Encryption at Rest

Encryption at Rest means:

Data is encrypted while it is stored inside storage or disk.

This protects stored data from unauthorized access if someone gains access to the physical storage.

Where It Is Used

Boot Volumes
Block Volumes
Object Storage Buckets
Databases
File Storage

OCI Example

A Block Volume is encrypted using a Vault Key.

Even if someone steals the disk/storage, they cannot read the data without the encryption key.

Real-Life Example

Think of a locked locker.

Data = valuables inside locker
Encryption key = locker key

Even if someone reaches the locker, they still cannot open it.

OCI Services Using Encryption at Rest

OCI Vault Keys
Block Volume Encryption
Bucket Encryption
Database Encryption

2. Encryption in Transit

Encryption in Transit means:

Data is encrypted while traveling across a network.

This protects data from hackers during communication between systems.

Where It Is Used

Browser to Website
Application to Database
API Communication
SSH Connections
HTTPS Traffic

OCI Example

When a user uploads a file to Object Storage using HTTPS:

User → HTTPS → OCI Object Storage

Data travels in encrypted format across the internet.

Real-Life Example

Think of sending a sealed envelope through courier service.

Even if someone intercepts the package during delivery, they cannot read the content.

Common Technologies Used

Encryption Type	Common Technology
Encryption at Rest	AES-256
Encryption in Transit	TLS / SSL / HTTPS

Key Difference

Feature	Encryption at Rest	Encryption in Transit
Protects Data	While stored	While moving
Used In	Storage systems	Network communication
Example	Encrypted bucket	HTTPS website
OCI Example	Block Volume Encryption	HTTPS API calls

Simple End-to-End Example

Scenario

A user uploads a file to OCI Object Storage.

Step 1 — During Upload

Laptop → HTTPS → OCI Bucket

✅ Encryption in Transit

Data is protected while moving through the internet.

Step 2 — After Upload

File Stored Inside Bucket

✅ Encryption at Rest

Data is protected while stored in OCI storage.

Interview Explanation

Encryption at Rest protects stored data using storage-level encryption, while Encryption in Transit protects data while it is moving across a network using protocols such as HTTPS/TLS.

Practical Example

Scenario

You are creating a Block Volume for a production database server.

Configuration

Setting	Value
Vault Name	ecommerce-prod-vault
Key Name	db-storage-key
Resource	Block Volume
Encryption Type	Customer Managed Key

Result:

Entire volume data becomes encrypted.

Benefits of Customer-Managed Encryption

Full key control
Better compliance
Key rotation support
Enterprise-grade security

Key Rotation

Key rotation means:

Creating a new version of encryption key regularly.

Benefits:

Better security
Reduced risk of key compromise

Advantages of Encryption at Rest

Data protection
Secure backups
Compliance support
Reduced security risks
Protects against storage theft

Limitations

Requires proper key management
Lost keys may cause data access issues
Advanced encryption setups may increase cost

Best Practices

Do

Use OCI Vault for key management
Rotate encryption keys regularly
Use least privilege IAM policies
Enable audit logging

Avoid

Hardcoding encryption credentials
Sharing keys manually
Using overly broad access permissions

Short Summary

Data Encryption at Rest in OCI protects stored data by encrypting it using encryption keys.

OCI supports:

Oracle-managed encryption
Customer-managed encryption using OCI Vault

It is used to secure:

Volumes
Databases
Object Storage
File Systems

Encryption ensures stored data remains unreadable to unauthorized users.