Description
An unencrypted CBS disk does not provide encryption protection for stored data. Disk encryption helps protect against exposure of the storage medium.
Potential impact
Unauthorized access to the storage medium can increase the risk of sensitive data disclosure.
Remediation
Set encrypt = true on tencentcloud_cbs_storage when creating the disk and prepare the required KMS permissions. Changing this setting replaces an existing disk, so back up data and plan its migration.
Examples
The examples create an encrypted disk. Encryption does not replace access controls in the operating system or application using the disk.
Before
hcl
resource "tencentcloud_cbs_storage" "storage" {
storage_name = "cbs-test"
storage_type = "CLOUD_SSD"
storage_size = 100
availability_zone = "ap-guangzhou-3"
}
After
hcl
resource "tencentcloud_cbs_storage" "storage" {
storage_name = "cbs-test"
storage_type = "CLOUD_SSD"
storage_size = 100
availability_zone = "ap-guangzhou-3"
encrypt = true
}