Encryption at rest
All block storage devices can be optionally encrypted at rest. Block storages include normal block storages, backups and custom images. Any block storage device can be encrypted, including the storage device holding the Cloud Server’s operating system.
Block storage encryption is fully transparent to the Cloud Server and requires no additional software to be installed or management of encryption keys on the server.
Encryption is available for all block storage tiers: MaxIOPS®, Standard and Archive.
Encryption is performed using Advanced Encryption Standard (AES) with 256-bit keys.
Encryption at Rest is offered free of charge.
Encrypting a storage device
Encryption can be enabled whenever a storage is created. Encryption cannot be enabled after creation, but a new encrypted copy can be created from an unencrypted storage device with the clone operation. Encrypted storage cannot be used as a clone source to make non-encrypted storage.
Backups and custom images created from an encrypted storage device are encrypted automatically. Storage devices created from an encrypted storage device, backup or custom image must also be encrypted:
- In the Control Panel, clones of encrypted storage devices and backups are always encrypted. When you deploy a server from an encrypted custom image, select Encrypted for the storage device.
- With the API, set
encryptedtoyeson the new storage device when you clone or deploy a server, otherwise the request fails.
Each storage device has a randomly generated encryption key, managed by UpCloud. The encryption keys themselves are stored encrypted.
To encrypt a storage device with keys you manage yourself, see Encrypt a Block Storage device with LUKS. For encryption across all UpCloud products, see Encryption.
Performance impact
Storage performance may be reduced by approximately 10-20% with encryption enabled when compared to unencrypted storage of the same type and size. Encryption can also make server creation and cloning operations take longer. The increase in operation time is proportional to the source template or storage size.
MaxIOPS is a registered trademark of UpCloud Ltd.