Volume encryption and key rotation
Manage storage encryption domains and preserve access through rotation and recovery.
Volume encryption protects stored block data under an assigned encryption domain. A domain defines the key provider and authorization used by storage services. It does not replace guest access control or application encryption.
Select an encryption domain
In the project's Storage → Volumes → Create volume form, inspect the encryption domain associated with each available storage policy. Storage policies declare a supported domain. A new volume inherits the selected policy's domain and records its key version. Projects can be restricted to approved domains without receiving permission to read provider key material.
A domain can use installation-managed keys or an approved external key service. For an external provider, configure its endpoint, trust chain, identity, and required key permissions before admitting volumes. Test decrypt and wrap actions from every storage failure domain that needs them.
Data keys and provider keys
Each volume has a data key protected by the domain's provider key. Storage services unwrap the data key through their authorized path. The control-plane resource records the reference and version without exposing the plaintext key in API reads.
A snapshot retains the information needed to read its captured blocks. Backups can use a separate destination encryption domain. Knowing the live volume's current key reference is insufficient to recover every historical backup.
Rotate provider material
Publish a new provider-key version and choose Encryption domain → Rotate. The preview lists live volumes, snapshots, and retained artifacts that still reference earlier versions. Rewrapping changes the protected data-key metadata; it does not imply that every block was rewritten.
The rotation operation records completed and pending references. Keep old provider versions usable until the inventory confirms that no retained resource requires them. An unavailable volume can keep a rotation incomplete without affecting already rotated volumes.
Key unavailability
When the provider cannot authorize a required unwrap, a start or attachment can
fail with encryption_key_unavailable. Infra does not substitute an unencrypted
volume. A running storage path can behave differently according to its active
key cache; test the domain's outage behavior before relying on it.
Restoring provider access and retrying the original operation is different from creating a new domain. A new empty key cannot decrypt data protected by the lost key. Deleting key material can make snapshots and backups permanently unreadable.
Transfer and recovery
A project transfer must preserve access to the encryption domain or explicitly rewrap through an approved transition. Cross-region recovery checks the target's key provider and residency policy before creating writable replacements.
Include key-provider configuration and recovery access in the installation's backup procedure. Use backup verification to test real decryption and restore, and Secrets API for integration credential rotation.