---
title: Encrypting Block Storage volumes with Key Manager via the Scaleway API
description: Learn how to encrypt Scaleway Block Storage volumes and their snapshots with a Key Manager key using the Block Storage API.
tags: block storage volume encryption key-manager kms snapshot
dates:
  validation: 2026-10-15
  posted: 2026-10-15
---
import Requirements from '@macros/iam/requirements.mdx'

You can encrypt your Block Storage volumes with a [Key Manager](/key-manager/) key. When you create a volume with a Key Manager key, the key protects the encryption of the volume. You manage this key yourself, and can [disable](/key-manager/how-to/disable-km-keys/) or [delete](/key-manager/how-to/delete-km-keys/) it at any time.

<Message type="important">
Block Storage volume encryption with Key Manager is currently in Private Beta, and is only available via the [Block Storage API](https://www.scaleway.com/en/developers/api/block/volume#create-a-volume).
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to perform actions in the intended Organization
- A valid [API key](/iam/credentials/create-api-keys/)
- Access to the Block Storage encryption with Key Manager Private Beta
- An existing [Key Manager key](/key-manager/how-to/create-km-key/) using [symmetric encryption](/key-manager/concepts/#symmetric-encryption) with the `AES-256-GCM` algorithm

## Limitations

- You can only encrypt additional volumes. You cannot encrypt boot volumes with a Key Manager key.
- You can only set the Key Manager key when you create a volume.
- You can only use symmetric encryption keys with the `AES-256-GCM` algorithm.
- Snapshots of an encrypted volume use the same Key Manager key as their parent volume. Volumes created from these snapshots also use the same key, and you cannot choose a different key.
- You cannot export a snapshot of an encrypted volume to an Object Storage bucket.

<Message type="important">
If you delete the Key Manager key used to encrypt a volume, you lose access to the volume and its snapshots once the volume is detached from its Instance. An attached volume remains readable, but you cannot reattach a detached volume or use its snapshots without the key.
</Message>

## Create an encrypted volume

Run the following command to create an encrypted Block Storage volume. Replace the placeholders with the appropriate values, and adjust the `size` (in bytes) and `perf_iops` values as needed:

```bash
curl -X POST \
  -H "X-Auth-Token: $SCW_SECRET_KEY" \
  -H "Content-Type: application/json" \
  "https://api.scaleway.com/block/v1/zones/<ZONE>/volumes" \
  -d '{
    "name": "my-encrypted-volume",
    "project_id": "<PROJECT_ID>",
    "perf_iops": 5000,
    "from_empty": {
      "size": 50000000000
    },
    "kms_key_id": "<KMS_KEY_ID>"
  }'
```

The `kms_key_id` field of the response contains the ID of the Key Manager key protecting the volume.

You can then [attach](/block-storage/how-to/attach-a-volume/) and [mount](/block-storage/how-to/mount-a-volume/) the encrypted volume like any other Block Storage volume. The Instance handles decryption, and you do not need any additional configuration.

To check whether Key Manager encrypts a volume, run the following command. If the `kms_key_id` field is `null`, Key Manager does not encrypt the volume.

```bash
curl -X GET \
  -H "X-Auth-Token: $SCW_SECRET_KEY" \
  "https://api.scaleway.com/block/v1/zones/<ZONE>/volumes/<VOLUME_ID>"
```

## Create a snapshot of an encrypted volume

Run the following command to create a snapshot of an encrypted volume. Replace the placeholders with the appropriate values:

```bash
curl -X POST \
  -H "X-Auth-Token: $SCW_SECRET_KEY" \
  -H "Content-Type: application/json" \
  "https://api.scaleway.com/block/v1/zones/<ZONE>/snapshots" \
  -d '{
    "volume_id": "<VOLUME_ID>",
    "name": "my-encrypted-snapshot",
    "project_id": "<PROJECT_ID>"
  }'
```

The snapshot uses the same Key Manager key as its parent volume. The `kms_key_id` field of the response contains the ID of this key.

## Going further

- See the [Block Storage API documentation](https://www.scaleway.com/en/developers/api/block/) for more information on volume and snapshot management.
- See the [Key Manager documentation](/key-manager/) for more information on how to manage your keys.