> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/platform/settings/ebs-volume-encryption.md).

# Custom EBS Volume Encryption

Dropzone provides a CloudFormation Template (CFT) to automatically create Key Management Service (KMS) keys with the permissions Dropzone needs to encrypt the elastic block storage (EBS) volumes that back your Dropzone instance. Providing your own keys allows you full control over your data with the ability to cut off Dropzone's access as you see fit.

The key in your primary instance region is used to encrypt all data on your Dropzone instance. Because KMS keys are only usable within the key's region, Dropzone requires a second key in the region used to maintain a remote copy of instance backups.

Each key is created with automatic rotation enabled. To prevent accidental deletions, each key is retained if the CloudFormation stack is ever deleted.

Download the CFT YAML using the following link: <https://dropzone-public.s3.us-west-2.amazonaws.com/cloud-formation-templates/DropzoneAWSKeys_EBSVolumeKeys.yaml>

{% hint style="info" %}
An optional value for the `AliasName` value can be provided if you would like to change the default alias name given to the key.
{% endhint %}

## Deploying the CloudFormation Template

Dropzone supports two methods of deployment: Command Line Interface (CLI) deployment or Manual.

The user/role used to deploy this CFT must have the following permissions in your AWS account:

| Permission Name                       | Purpose                                                                                                                                                           |
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| cloudformation:CreateChangeSet        | Allows the user to execute the [CreateChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateChangeSet.html) action               |
| cloudformation:DescribeChangeSet      | Allows the user to execute the [DescribeChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeChangeSet.html) action           |
| cloudformation:ExecuteChangeSet       | Allows the user to execute the [ExecuteChangeSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_ExecuteChangeSet.html) action             |
| cloudformation:DescribeStacks         | Allows the user to execute the [DescribeStacks](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStacks.html) action                 |
| cloudformation:DescribeStackEvents    | Allows the user to execute the [DescribeStackEvents](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackEvents.html) action       |
| cloudformation:DescribeStackResources | Allows the user to execute the [DescribeStackResources](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DescribeStackResources.html) action |
| cloudformation:GetTemplate            | Allows the user to execute the [GetTemplate](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetTemplate.html) action                       |
| kms:CreateKey                         | Allows the user to create a unique KMS key                                                                                                                        |
| kms:DescribeKey                       | Allows the user to see the details of the KMS key                                                                                                                 |
| kms:PutKeyPolicy                      | Allows the user to attach a [key policy](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html) to the KMS key                                  |
| kms:EnableKeyRotation                 | Allows the user to enable automatic rotation of the KMS key material                                                                                              |
| kms:CreateAlias                       | Allows the user to create a user-friendly name for the KMS key                                                                                                    |
| kms:UpdateAlias                       | Allows the user to associate an existing AWS KMS alias with a different KMS key                                                                                   |
| kms:DeleteAlias                       | Allows the user to delete the name of the KMS key                                                                                                                 |

### CLI Deployment

To complete CLI deployment, do the following:

* As an authenticated user with the required permissions and default AWS profile configured, `cd` into the directory where you downloaded the CFT
* Input the following text

```
# Replace xxxxxx with the region values provided by your Dropzone representative
INSTANCE_REGION=xxxxxx
BACKUP_REGION=xxxxxx

for region in $INSTANCE_REGION $BACKUP_REGION ; do
  aws cloudformation deploy --region "$region" \
    --template-file DropzoneAWSKeys_EBSVolumeKeys.yaml \
    --stack-name dropzone-ebs-key

  echo "$region $(aws cloudformation describe-stacks --region "$region" \
    --stack-name dropzone-ebs-key \
    --query 'Stacks[0].Outputs[?OutputKey==`KeyArn`].OutputValue' \
    --output text)"
done
```

* This should generate the key ARN values
* Send the lines with the key ARNs back to Dropzone to be applied to your instance

### Manual Deployment

You will need to deploy the CFT twice, once in the instance region and again in the backup region.

To complete manual deployment, do the following:

* Log into your AWS account
* Go to the CloudFormation console, <https://console.aws.amazon.com/cloudformation/>
* Click on "Create Stack" > "With new resources (standard)"

<figure><img src="/files/ZNBVfHb3ehBhPzk7jj0a" alt=""><figcaption><p>Create Stack Button</p></figcaption></figure>

{% hint style="warning" %}
If this is your first stack, then the option will not have "With new resources"

<img src="/files/XdYtPZEUWQDwAg0v61gv" alt="Create Stack Button" data-size="original">
{% endhint %}

* In the "Prerequisite - Prepare template" section, select "Upload a template file"
* Upload the CFT YAML file you downloaded earlier
* Click "Next"
* Enter a "Stack name", e.g. "Dropzone-AI"

<figure><img src="/files/h2XGkoJRztbyv9Zt4fwY" alt=""><figcaption><p>Stack Name</p></figcaption></figure>

* In the Parameters section, input the values for the parameters that were defined in the template
* Click "Next"
* On the "Configure stack options" page, click "Next"
* On the "Review and create" page, click "Submit"

<figure><img src="/files/x107LliDtoQ9Ykgl2ck9" alt=""><figcaption><p>Create the stack via the Submit button</p></figcaption></figure>

* Once the stack creation is complete, click "Resources"
* Record the key ARN value shown
* Once you are done, send both the primary and backup region key ARNs back to Dropzone to be applied to your instance