# EBS Volume Encryption (FedRAMP)

## Table of Contents

- [FedRAMP Encryption Requirements](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#fedramp-requirements)
- [Prerequisites](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#prerequisites)
- [Create a Customer-Managed KMS Key](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#kms-key)
- [Configure the KMS Key Policy](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#kms-key-policy)
- [Create an Encrypted StorageClass](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#storage-class)
- [Configure Helm Values](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#helm-values)
- [Enable Account-Level EBS Encryption Default (Optional)](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#set-default-encryption)
- [Validate Encryption](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#validation)
- [Audit: CloudTrail KMS Logging](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#cloudtrail-audit)
- [References](https://docs.kloudfuse.com/platform/4.1.0/setup/fed/ebs-encryption/#references)

FedRAMP High and Moderate baselines require encryption at rest for all persistent data. This page covers configuring AWS EBS volume encryption for Kloudfuse FED deployments using a customer-managed KMS key (CMK), which satisfies the FedRAMP SC-28 (Protection of Information at Rest) control family.

|     |     |
| --- | --- |
|  | This page applies to the `kfuse-fed` chart only. Standard (`kfuse`) deployments follow the same EBS encryption steps, but FedRAMP compliance also requires the managed services (RDS, ElastiCache, MSK) and S3 buckets to be encrypted — those are covered in their respective setup pages. |

## FedRAMP Encryption Requirements

FedRAMP mandates the following for data at rest:

- **FIPS 140-2 validated encryption** — AES-256 using AWS KMS with a customer-managed key satisfies this requirement for EBS.
- **Customer-managed keys (CMK)** — the encryption key must be under agency control; AWS-managed keys (`aws/ebs`) do not satisfy FedRAMP High key management requirements.
- **Key rotation** — CMKs must have automatic annual rotation enabled.
- **Audit trail** — all KMS API calls must be logged to AWS CloudTrail.

| NIST SP 800-53 Control | Requirement | How EBS CMK satisfies it |
| --- | --- | --- |
| SC-28 | Protect information at rest | AES-256 encryption on all EBS volumes |
| SC-12 | Cryptographic key establishment and management | Customer-managed KMS key with defined lifecycle |
| SC-13 | Cryptographic protection | FIPS 140-2 validated AWS KMS HSMs |
| AU-2, AU-9 | Audit events and protection of audit information | KMS key usage logged in CloudTrail |

## Prerequisites

- AWS CLI configured with permissions to create KMS keys and IAM policies
- EKS cluster with the **EBS CSI driver** installed (see [EBS CSI driver prerequisites](https://docs.kloudfuse.com/platform/4.1.0/setup/storage/iops-aws/#prerequisites))
- CloudTrail enabled in the AWS account for KMS audit logging

Set the required environment variables before running the commands on this page:

```console
export NAMESPACE=<your-namespace>
export AWS_REGION=<aws-region>
export AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
export CLUSTER_NAME=<your-eks-cluster-name>
```

## Create a Customer-Managed KMS Key

Create a dedicated CMK for EBS encryption with automatic annual rotation enabled:

```console
KMS_KEY_ID=$(aws kms create-key \
  --description "Kloudfuse EBS encryption key - FedRAMP" \
  --key-usage ENCRYPT_DECRYPT \
  --origin AWS_KMS \
  --region "$AWS_REGION" \
  --query 'KeyMetadata.KeyId' --output text)

echo "KMS Key ID: $KMS_KEY_ID"

# Create a human-readable alias
aws kms create-alias \
  --alias-name "alias/kfuse-ebs-fedramp" \
  --target-key-id "$KMS_KEY_ID" \
  --region "$AWS_REGION"

# Enable automatic annual key rotation (required for FedRAMP)
aws kms enable-key-rotation \
  --key-id "$KMS_KEY_ID" \
  --region "$AWS_REGION"
```

Verify rotation is enabled:

```console
aws kms get-key-rotation-status \
  --key-id "$KMS_KEY_ID" \
  --region "$AWS_REGION" \
  --query 'KeyRotationEnabled'
```

The output must be `true`.

## Configure the KMS Key Policy

The EBS CSI driver’s service account role and the EKS node IAM role must be granted `kms:GenerateDataKeyWithoutPlaintext`, `kms:Decrypt`, and `kms:CreateGrant` permissions. Replace the placeholders with your actual role ARNs:

```console
aws kms put-key-policy \
  --key-id "$KMS_KEY_ID" \
  --policy-name default \
  --region "$AWS_REGION" \
  --policy '{
    "Version": "2012-10-17",
    "Statement": [\
      {\
        "Sid": "Enable IAM User Permissions",\
        "Effect": "Allow",\
        "Principal": {\
          "AWS": "arn:aws:iam::'"$AWS_ACCOUNT_ID"':root"\
        },\
        "Action": "kms:*",\
        "Resource": "*"\
      },\
      {\
        "Sid": "Allow EBS CSI driver to use the key",\
        "Effect": "Allow",\
        "Principal": {\
          "AWS": [\
            "arn:aws:iam::'"$AWS_ACCOUNT_ID"':role/<ebs-csi-irsa-role>",\
            "arn:aws:iam::'"$AWS_ACCOUNT_ID"':role/<eks-node-role>"\
          ]\
        },\
        "Action": [\
          "kms:GenerateDataKeyWithoutPlaintext",\
          "kms:Decrypt",\
          "kms:CreateGrant",\
          "kms:DescribeKey"\
        ],\
        "Resource": "*"\
      }\
    ]
  }'
```

## Create an Encrypted StorageClass

Define a StorageClass that references the CMK. All PVCs using this StorageClass will be encrypted with the customer-managed key.

```yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: kfuse-encrypted-gp3
provisioner: ebs.csi.aws.com
parameters:
  type: gp3
  encrypted: "true"
  kmsKeyId: <kms-key-arn>
  iops: "6000"
  throughput: "300"
volumeBindingMode: WaitForFirstConsumer
allowVolumeExpansion: true
reclaimPolicy: Retain
```

Apply the StorageClass to your cluster:

```console
kubectl apply -f storageclass-encrypted-gp3.yaml
```

## Configure Helm Values

Reference the encrypted StorageClass across all stateful Kloudfuse components in your `custom-values.yaml`:

```yaml
pinot:
  server:
    persistence:
      storageClass: kfuse-encrypted-gp3
      size: 500Gi
  controller:
    persistence:
      storageClass: kfuse-encrypted-gp3
      size: 100Gi
  zookeeper:
    persistence:
      storageClass: kfuse-encrypted-gp3
      size: 20Gi

kafka:
  persistence:
    storageClass: kfuse-encrypted-gp3
    size: 200Gi
  zookeeper:
    persistence:
      storageClass: kfuse-encrypted-gp3
      size: 20Gi

kfuse-configdb:
  primary:
    persistence:
      storageClass: kfuse-encrypted-gp3
      size: 50Gi
```

## Enable Account-Level EBS Encryption Default (Optional)

To ensure no unencrypted EBS volume can be provisioned in the AWS account — a defense-in-depth measure aligned with FedRAMP — enable the account-level EBS encryption default:

```console
aws ec2 enable-ebs-encryption-by-default \
  --region "$AWS_REGION"

# Set the account default KMS key to your CMK
aws ec2 modify-ebs-default-kms-key-id \
  --kms-key-id "$KMS_KEY_ID" \
  --region "$AWS_REGION"
```

## Validate Encryption

After deploying Kloudfuse, confirm that all PVC-backed EBS volumes are encrypted with the CMK:

```console
# List PVs and their corresponding EBS volume IDs
kubectl get pv -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.csi.volumeHandle}{"\n"}{end}'
```

```console
# Check encryption status for a specific volume
aws ec2 describe-volumes \
  --volume-id <vol-id> \
  --region "$AWS_REGION" \
  --query 'Volumes[0].{Encrypted:Encrypted,KmsKeyId:KmsKeyId}'
```

## Audit: CloudTrail KMS Logging

FedRAMP AU-2 requires logging of cryptographic key usage. Verify that CloudTrail is recording KMS events:

```console
aws cloudtrail get-event-selectors \
  --trail-name <your-trail-name> \
  --region "$AWS_REGION"
```

To query recent KMS usage for the CMK:

```console
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue="$KMS_KEY_ID" \
  --region "$AWS_REGION" \
  --max-results 20
```

## References

- [AWS FedRAMP compliance overview](https://aws.amazon.com/compliance/fedramp/)
- [Amazon EBS encryption](https://docs.aws.amazon.com/ebs/latest/userguide/EBSEncryption.html)
- [Amazon EBS encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html)
- [Creating KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/create-keys.html)
- [Rotating AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html)
- [KMS key policies](https://docs.aws.amazon.com/kms/latest/developerguide/key-policies.html)
- [AWS EBS CSI driver StorageClass parameters](https://github.com/kubernetes-sigs/aws-ebs-csi-driver/blob/master/docs/parameters.md)
- [Amazon EBS CSI driver for EKS](https://docs.aws.amazon.com/eks/latest/userguide/ebs-csi.html)
- [NIST SP 800-53 Rev 5 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [FedRAMP Security Controls Baseline](https://www.fedramp.gov/assets/resources/documents/FedRAMP_Security_Controls_Baseline.xlsx)