LAB 22 ‐ Encrypt OCI Storage with Master Encryption Key (MEK) - gautam-amitesh/OCI GitHub Wiki

Encrypting Boot Volume

  1. Navigation

    Navigation menu > Storage > Block Storage > Boot Volumes

  2. Click three dot Actions menu of the specific boot volume and click Assign master encryption key

  3. Select Vault compartment, Vault, Master encryption key compartment, and Master encryption key then click Assign

  4. If it throws an error like shown in below snapshot, most likely you are missing policy

  5. To fix this go to policy creation and click Create Policy and fill in the details

    Allow service blockstorage to use keys in compartment <Your_Compartment_Name>
Allow group <Your_Group_Name> to use key-delegates in compartment <Your_Compartment_Name>
Allow group <Your_Group_Name> to use keys in compartment <Your_Compartment_Name>

  6. Now again try to assign key this time it will work

  7. To unassign master encryption key or to edit it, click Actions menu and then Unassign master encryption key or Edit master encryption key

Encrypting Block Volume

  1. Navigation

    Navigation menu > Storage > Block Storage > Block Volumes

  2. Click three dot Actions menu of the specific block volume and click Assign master encryption key\

  3. Select Vault compartment, Vault, Master encryption key compartment, and Master encryption key then click Assign

  4. To unassign master encryption key or to edit it, click Actions menu and then Unassign master encryption key or Edit master encryption key

Encrypting Bucket

  1. Navigation

    Navigation menu > Storage > Object Storage & Archive Storage > Buckets

  2. Click on the specific bucken name to headover to the details page

  3. On the details page find Encryption key and click Assign key

  4. Select Vault compartment, Vault, Master encryption key compartment, and Master encryption key then click Assign

  5. If you encounter an error like shown in below snapshot then you will again need to add a policy statement

  6. To fix this go to policy creation and click Create Policy and fill in the details

    Allow service objectstorage-us-ashburn-1 to use keys in compartment <Your_Compartment_Name>

  7. Let's try again

  8. If you want to unassign or edit key you can do it by clicking on the Actions menu