Encrypting Block Storage volumes with Key Manager via the Scaleway API

You can encrypt your Block Storage volumes with a Key Manager key. When you create a volume with a Key Manager key, the key protects the encryption of the volume. You manage this key yourself, and can disable or delete it at any time.

Before you start

To complete the following actions, you must have:

• A Scaleway account logged into the console (External link)
• Owner status or IAM permissions allowing you to perform actions in the intended Organization
• A valid API key
• Access to the Block Storage encryption with Key Manager Private Beta
• An existing Key Manager key using symmetric encryption with the AES-256-GCM algorithm

Limitations

• You can only encrypt additional volumes. You cannot encrypt boot volumes with a Key Manager key.
• You can only set the Key Manager key when you create a volume.
• You can only use symmetric encryption keys with the AES-256-GCM algorithm.
• Snapshots of an encrypted volume use the same Key Manager key as their parent volume. Volumes created from these snapshots also use the same key, and you cannot choose a different key.
• You cannot export a snapshot of an encrypted volume to an Object Storage bucket.

Create an encrypted volume

Run the following command to create an encrypted Block Storage volume. Replace the placeholders with the appropriate values, and adjust the size (in bytes) and perf_iops values as needed:

curl -X POST \
  -H "X-Auth-Token: $SCW_SECRET_KEY" \
  -H "Content-Type: application/json" \
  "https://api.scaleway.com/block/v1/zones/<ZONE>/volumes" \
  -d '{
    "name": "my-encrypted-volume",
    "project_id": "<PROJECT_ID>",
    "perf_iops": 5000,
    "from_empty": {
      "size": 50000000000
    },
    "kms_key_id": "<KMS_KEY_ID>"
  }'

The kms_key_id field of the response contains the ID of the Key Manager key protecting the volume.

You can then attach and mount the encrypted volume like any other Block Storage volume. The Instance handles decryption, and you do not need any additional configuration.

To check whether Key Manager encrypts a volume, run the following command. If the kms_key_id field is null, Key Manager does not encrypt the volume.

curl -X GET \
  -H "X-Auth-Token: $SCW_SECRET_KEY" \
  "https://api.scaleway.com/block/v1/zones/<ZONE>/volumes/<VOLUME_ID>"

Create a snapshot of an encrypted volume

Run the following command to create a snapshot of an encrypted volume. Replace the placeholders with the appropriate values:

curl -X POST \
  -H "X-Auth-Token: $SCW_SECRET_KEY" \
  -H "Content-Type: application/json" \
  "https://api.scaleway.com/block/v1/zones/<ZONE>/snapshots" \
  -d '{
    "volume_id": "<VOLUME_ID>",
    "name": "my-encrypted-snapshot",
    "project_id": "<PROJECT_ID>"
  }'

The snapshot uses the same Key Manager key as its parent volume. The kms_key_id field of the response contains the ID of this key.

Going further

• See the Block Storage API documentation (External link) for more information on volume and snapshot management.
• See the Key Manager documentation for more information on how to manage your keys.