Ensure Cloud Object Storage Encryption is set to On with KYOK

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

You can use the IBM Cloud Object Storage bucket configuration properties to verify whether a Cloud Object Storage bucket is configured to use Hyper Protect Crypto Services key management service. Using Console: Navigate to your Cloud Object Storage instance: 1. Log in to IBM Cloud at https://cloud.ibm.com 2. Click the Menu icon and select Resource List 3. On the Resource List page under Storage, select the Cloud Object Storage instance that you have provisioned. 4. Click on the appropriate bucket that you would like to check 5. Click on Configuration and scroll down to Associated key management service to check/confirm if Hyper Protect Crypto Services key is configured with the bucket

How it is fixed

Fix method: Guidance or infrastructure patch

You will not be able to add Hyper Protect Crypto Services as the key management service once data is already written to a Cloud Object Storage bucket. In order to ensure that objects are encrypted using Hyper Protect Crypto Services root keys you will need to create a new Cloud Object Storage bucket, set it to use Hyper Protect Crypto Services key management service and then upload/copy the existing objects to this new bucket.