🔐 Using OCI Vault for Boot & Block Volume Encryption

Secure your compute resources by creating Vaults, managing Encryption Keys, and applying them to Boot and Block Volumes in OCI.

---

✅ 1. Create a Vault

1. Open the Search Menu and search for Vault → click the Vault option
   Alternatively: ☰ → Identity & Security → Key Management & Secret Management

Figure 1. Navigate to Vault service

Figure 2. Vault dashboard

2. Click Create Vault → Provide name, compartment, and select Default Management type.

Figure 3. Start vault creation

Figure 4. Configure vault name and compartment

Figure 5. Select vault type

Figure 6. Vault successfully created

---

🧭 2. Create Encryption Keys

Once the vault is created, navigate inside it and click Create Key.

Figure 7. Create a new key

Figure 8. Provide key name and type

Figure 9. Key creation completed

---

🔁 3. Rotate Keys Periodically

Rotating keys quarterly or biannually ensures new data is encrypted with the latest version of the key. Existing data remains accessible.

Figure 10. Rotate keys from key actions menu

Figure 11. Confirm rotation

Figure 12. Rotation progress

Figure 13. Key rotated successfully

Figure 14. Key version history

---

💻 4. Encrypt Boot Volume with Custom Keys

1. ☰ → Storage → Boot Volumes → Select volume → Encryption Key → Assign

Figure 15. Boot volume details

Figure 16. Assign KMS key

If you encounter permission errors, create a policy that allows Block Storage to use keys in the Vault compartment:

Allow service blockstorage to use keys in compartment <vault-compartment-name>