Docs

Elastic Compute Service

Elastic Block Storage

Encrypted volumes

To meet data security and compliance requirements and effectively defend against threats such as physical theft and unauthorized access, you can encrypt your ECS volumes using Key Management Service (KMS). This ensures the confidentiality and integrity of your business data.

Notes

Encrypted volumes are currently in closed beta. Please contact your account manager for access.

The volumes discussed in this topic are all data volumes. System volumes are automatically created and attached when instances are created, and cannot be created independently.

Make sure you have activated KMS. For instructions, see Key Management Quick Start.

Encrypted volumes are currently only available in China (Shanghai). If you need to use them in another region, please contact your account manager for assistance.

How it works

An encrypted volume uses two encryption keys to ensure the security of your data:

Data key: Used to encrypt and decrypt volume data.

KMS-managed key: Used to encrypt and decrypt the data key.

When an encrypted volume is created, the data key is encrypted with the KMS key and stored within the volume. During instance startup, ECS requests that KMS decrypt the data key. The decrypted plaintext data key is then loaded into memory and used to encrypt or decrypt data.

KMS keys come in two types:

Service key: A key that is automatically created and managed by KMS for ECS with the alias Default Service Key(managed_ebs_key). This key meets basic data encryption requirements and is easy to use since you do not need to manage it throughout its lifecycle.

Customer master key: A key that you import or create in KMS, over which you have full control. It is ideal if you need strong data security and want to manage tasks such as key rotation, disabling, and deletion yourself.

Creating an encrypted volume

In the ECS console, go to the Volumes page and click "Create volume".

On the "Create volume" page, check the box for "Encryption".

tip

If you have not allowed ECS to access KMS, click "Unauthorized, authorize access to KMS first".

On the "Cross-service access request" page, verify your IAM role and click "Authorize now". Wait three seconds after authorization is complete, and the system will automatically return to the "Create volume" page.

On the "Create volume" page, click the "Please select" drop‑down list and choose the KMS key you want to use.

Configure other parameters based on your needs. For descriptions of volume parameters, see Creating a volume.

Under "Order details", check the box that says "I have read and agree to Elastic Compute Service Terms of Service", and click "Create volume" to submit your order.

Creating an encrypted volume from an encrypted snapshot

When you create an encrypted volume from an encrypted snapshot, the new volume initially contains all of the snapshot's data. Steps:

In the ECS console, go to the Volumes page and click "Create volume".

On the "Create volume" page, click "Create from snapshot" in the "Data source" section.

In the "Select Snapshot" panel that appears, select the desired encrypted snapshot and click "OK".

Configure other parameters based on your needs. For descriptions of volume parameters, see Creating a volume.

Verifying that a volume is encrypted

warning

This method verifies encryption by disabling keys, which can result in read/write errors on the system volume. We recommend using a test instance for testing purposes.

When creating an ECS test instance, use a system volume that is encrypted with a customer master key.

Disable the customer master key.

In the KMS console, on the customer master key page, select the region where your key is located.

On the "customer master key" page, find your key and click "detail" in the "operation" column.

On the "Key Ring Details" page, disable the key by toggling off the switch in the "state" column. In the box that appears, click "OK".

Verify that the volume is encrypted.

After disabling the KMS key, you can verify that the volume is encrypted by looking for the following behaviors:

You cannot stop, restart, or delete the instance in the console.

After the volume is detached, it cannot be reattached.

For one week after the key is disabled, you can continue to read and write data to the volume. After more than a week, however, you will no longer be able to perform any read or write operations on the volume.

Re‑enable the KMS key and release the test instance.

Billing notes

Volume costs

The billing rules for encrypted and non-encrypted volumes are the same, and using the encryption feature does not incur additional fees. For more information, see Volume billing.

Key charges

Customer master key (CMK): If you choose to use your own CMK for encryption, KMS will charge you separately for the related key management and invocation fees.

Service key: There are no additional charges for using the default service key for encryption.

Quotas and limits

Instance type

Only third-generation and later instances are supported when you encrypt a system volume or create an encrypted data volume from a snapshot.

Volume type

Only ESSD PL0 and ESSD FlexPL volumes are supported when you encrypt a system volume or create an encrypted data volume from a snapshot.

Changing the encryption type

You cannot directly change the encryption type of an existing volume. However, you can achieve this indirectly by selecting a new KMS key when creating a new volume from a snapshot of the original.

Last updated: 2026.06.03 17:05:25