// Module included in the following assemblies:
//
// * cloud_experts_tutorials/cloud-experts-getting-started/cloud-experts-getting-started-what-is-rosa.adoc

:_mod-docs-content-type: CONCEPT
[id="cloud-experts-key-features-rosa-encryption_{context}"]
= Encryption

[role="_abstract"]
{product-title} uses encryption keys stored in KMS to encrypt EBS volumes, with options for customer-provided keys, data encryption at rest, and etcd encryption.

== Encryption keys
{product-title} uses a key stored in KMS to encrypt EBS volumes. Customers also have the option to provide their own KMS keys at cluster creation.

== KMS keys
If you specify a KMS key, the control plane, infrastructure and worker node root volumes and the persistent volumes are encrypted with the key.

== Data encryption
By default, there is encryption at rest. The AWS Storage platform automatically encrypts your data before persisting it and decrypts the data before retrieval. See link:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html[AWS EBS Encryption] for more details.

You can also encrypt etcd in the cluster, combining it with AWS storage encryption. This results in double the encryption which adds up to a 20% performance hit.

== etcd encryption
etcd encryption can only be enabled at cluster creation.

[NOTE]
====
etcd encryption incurs additional overhead with negligible security risk mitigation.
====

== etcd encryption configuration
etcd encryption is configured the same as in OpenShift Container Platform. The aescbc cypher is used and the setting is patched during cluster deployment. For more details, see the link:https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/[Kubernetes documentation].

== Multi-region KMS keys for EBS encryption
Currently, the {rosa-cli} does not accept multi-region KMS keys for EBS encryption. This feature is in our backlog for product updates. The {rosa-cli} accepts single region KMS keys for EBS encryption if it is defined at cluster creation.
