Object Storage Buckets Encrypted with Customer-Managed Keys

01 Sign in to your Oracle Cloud Infrastructure (OCI) account.

02 Navigate to Object Storage & Archive Storage console available at https://cloud.oracle.com/object-storage/.

03 In the left navigation panel, choose Buckets, and select an OCI compartment from the Compartment dropdown menu, to list the Object Storage buckets available within that compartment.

04 Click on the name (link) of the bucket that you want to examine, listed in the Name column.

05 Select the Bucket Information tab and check the Encryption Key attribute value, listed under Features. If Encryption Key is set to Oracle managed key, encryption at rest using Customer-Managed Keys (CMKs) is not enabled for the selected OCI Object Storage bucket.

06 Repeat steps no. 4 and 5 for each Object Storage bucket created in the selected Oracle Cloud Infrastructure (OCI) compartment.

07 Repeat steps no. 3 – 6 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.

01 Run iam compartment list command (Windows/macOS/Linux) with output query filters to list the ID of each compartment available in your Oracle Cloud Infrastructure (OCI) account:

oci iam compartment list
	--all
	--include-root
	--query 'data[]."id"'

02 The command output should return the requested OCI compartment identifiers (OCIDs):

[
	"ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
	"ocid1.compartment.oc1..abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd"
]

03 Run os bucket list command (Windows/macOS/Linux) with the ID of the OCI compartment that you want to examine as the identifier parameter, the list the name of each Object Storage bucket available in the selected OCI compartment:

oci os bucket list
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--all
	--query 'data[]."name"'

04 The command output should return the requested bucket names:

[
	"cc-project5-data-bucket",
	"cc-tenancy-logging-bucket",
	"cc-cloud-artifacts-bucket",
	"cc-project5-cloud-guard-bucket"
]

05 Run os bucket get command (Windows/macOS/Linux) with the name of the Object Storage bucket that you want to examine as the identifier parameter and custom output filters to determine if encryption at rest using Customer-Managed Keys (CMKs) is enabled for the selected bucket:

oci os bucket get
	--bucket-name 'cc-project5-data-bucket'
	--query 'data.{"kms-key-id":"kms-key-id"}'

06 The command output should return the ID of the Customer-Managed Key (CMK) configured for the selected bucket:

{
	"kms-key-id": null
}

07 Repeat steps no. 5 and 6 for each Object Storage bucket provisioned in the selected OCI compartment.

08 Repeat steps no. 3 – 7 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.

01 Sign in to your Oracle Cloud Infrastructure (OCI) account.

02 Navigate to Key Management & Secret Management console available at https://cloud.oracle.com/security/kms.

03 In the left navigation panel, choose Vault, and select the OCI compartment where you want to deploy the new Vault, from the Compartment dropdown menu.

04 Choose Create Vault and perform the following actions to create the OCI Vault that will store your new Customer-Managed Key (CMK):

1. For Create in Compartment, select the appropriate OCI compartment.
2. For Name, enter a unique name for the new Vault.
3. (Optional) Check the Make it a virtual private vault setting checkbox if you want a dedicated partition in a Hardware Security Module (HSM).
4. (Optional) Choose Show advanced options and use the Tag key and Tag value fields to improve resource management by adding tags.
5. Choose Create Vault to deploy your new OCI Vault.

05 Once the Vault deployment is complete, click on the name (link) of the new OCI Vault instance, listed in the Name column.

06 In the Resources navigation panel, select Master Encryption Keys, choose Create Key, and perform the following actions to create the Customer-Managed Key (CMK) required for Object Storage bucket encryption:

1. For Create in Compartment, select the appropriate OCI compartment.
2. For Protection Mode, choose the suitable protection mode for your key. The protection mode indicates how the key persists and where cryptographic operations that use the key are performed. Choose HSM to store and process the key on a Hardware Security Module (recommended for use cases with stringent compliance requirements) or Software to store and process the key on a server (recommended for most use cases). For more details about key protection modes, see the OCI official documentation.
3. For Name, enter a unique name for the new encryption key.
4. For Key Shape: Algorithm and Key Shape: Length, choose AES (Symmetric key used for Encrypt and Decrypt) with 256 bits.
5. (Optional) Choose Show advanced options and use the Tag key and Tag value fields to add tags to organize your resource.
6. Choose Create Key to generate your new encryption key.

07 Once your new Customer-Managed Key (CMK) is available, navigate to Object Storage & Archive Storage console available at https://cloud.oracle.com/object-storage/.

08 In the left navigation panel, choose Buckets, and select an OCI compartment from the Compartment dropdown menu, to list the Object Storage buckets available within that compartment.

09 Click on the name (link) of the bucket that you want to configure, listed in the Name column.

10 Select the Bucket Information tab to access the configuration information available for the selected bucket.

11 In the Features section, choose Assign next to Encryption Key attribute value to assign your new CMK.

12 On the Assign Master Encryption Key configuration panel, provide the following information:

1. For Vault in \<compartment-name\>, select the name of the OCI Vault created in step no. 4.
2. For Master Encryption Key \<compartment-name\> select the name of the Customer-Managed Key created in step no. 6.
3. Choose Assign to apply the Customer-Managed Key (CMK) key to your Object Storage bucket.

13 Repeat steps no. 9 - 12 for each bucket that you want to encrypt with a Customer-Managed Key (CMK), available in the selected Oracle Cloud Infrastructure (OCI) compartment.

14 Repeat steps no. 2 – 13 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.

01 Run kms management vault create command (Windows/macOS/Linux) to create the OCI Vault that will store your new Customer-Managed Key (CMK):

oci kms management vault create
	--display-name 'cc-project5-oci-vault'
	--vault-type 'DEFAULT'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'

02 The command output should return the configuration information available for the new OCI Vault:

{
	"data": {
		"compartment-id": "ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
		"crypto-endpoint": null,
		"defined-tags": {},
		"display-name": "cc-project5-oci-vault",
		"external-key-manager-metadata-summary": null,
		"freeform-tags": {},
		"id": "ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234",
		"is-primary": true,
		"is-vault-replicable": null,
		"lifecycle-state": "CREATING",
		"management-endpoint": null,
		"replica-details": null,
		"restored-from-vault-id": null,
		"time-of-deletion": null,
		"vault-type": "DEFAULT",
		"wrappingkey-id": ""
	},
	"etag": "abcd1234abcd1234abcd1234abcd1234abcd1234"
}

03 Run kms management vault get command (Windows/macOS/Linux) to describe the management endpoint configured for the OCI Vault created in the previous steps:

oci kms management vault get
	--vault-id 'ocid1.vault.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234'
	--query 'data."management-endpoint"'

04 The command output should return the URL of the management endpoint configured for the selected Vault:

"https://abcd1234abcda-management.kms.ap-sydney-1.oraclecloud.com"

05 Run kms management key create command (Windows/macOS/Linux) to create a new KMS Customer-Managed Key (CMK) for your OCI Vault. For --key-shape parameter, specify the key shape algorithm and length. For --protection-mode parameter, specify the suitable protection mode for your key. For the --endpoint parameter, specify the OCI Vault management endpoint returned in the previous step:

oci kms management key create
	--display-name 'cc-project5-oci-key'
	--key-shape '{"algorithm":"AES","length":32}'
	--protection-mode 'SOFTWARE'
	--endpoint 'https://abcd1234abcda-management.kms.ap-sydney-1.oraclecloud.com'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--query 'data."id"'

06 The command output should return the configuration information available for the new KMS key:

"ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd"

07 Run os bucket update command (Windows/macOS/Linux) with the name of the Object Storage bucket that you want to configure as the identifier parameter, to enable encryption at rest with KMS Customer-Managed Keys (CMKs) for the selected bucket. For the --kms-key-id parameter, specify the ID of your Customer-Managed Key, returned in the previous step:

oci os bucket update
	--bucket-name 'cc-project5-data-bucket'
	--kms-key-id 'ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'
	--compartment-id 'ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd'

08 The command output should return the configuration information available for the modified bucket:

{
	"data": {
		"approximate-count": null,
		"approximate-size": null,
		"auto-tiering": "Disabled",
		"compartment-id": "ocid1.tenancy.oc1..aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
		"id": "ocid1.bucket.oc1.ap-sydney-1.aaaabbbbccccddddabcdabcd1234abcd1234abcd1234abcd1234abcd1234",
		"is-read-only": false,
		"kms-key-id": "ocid1.key.oc1.ap-sydney-1.abcd1234abcda.aaaabbbbccccddddabcd1234abcd1234abcd1234abcd1234abcd1234abcd",
		"metadata": {},
		"name": "cc-project5-data-bucket",
		"namespace": "abcd1234abcd1234",
		"object-events-enabled": false,
		"object-lifecycle-policy-etag": null,
		"public-access-type": "NoPublicAccess",
		"replication-enabled": false,
		"storage-tier": "Standard",
		"versioning": "Disabled"
	},
	"etag": "abcd1234-abcd-1234-abcd-abcd1234abcd"
}

09 Repeat steps no. 7 and 8 for each bucket that you want to encrypt with a Customer-Managed Key (CMK), provisioned in the selected Oracle Cloud Infrastructure (OCI) compartment.

10 Repeat steps no. 1 – 9 for each OCI compartment available in your Oracle Cloud Infrastructure (OCI) account.