All Products
Search

This Product

    Elastic Compute Service:EnableDiskEncryptionByDefault

    Document Center

    Elastic Compute Service:EnableDiskEncryptionByDefault

    Last Updated:Sep 14, 2026

    Enables account-level default encryption for block storage in a specified region.

    Operation description

    Note

    The EBS account-level default encryption feature is currently available only in specific regions and for specific users. If you need this feature, submit a ticket.

    • Before you begin

    • Precautions

      • After account-level default encryption for block storage is enabled, all newly created pay-as-you-go or subscription cloud disks must be encrypted. You can use the KMS key ID configured for account-level default encryption for block storage, or specify a different KMS key ID.

      • When account-level default encryption for block storage is enabled for the first time, the service key is used by default.

    • Recommendations

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

    • Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.

    • API: The API that you can call to perform the action.

    • Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.

    • Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.

      • For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.

      • For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.

    • Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.

    • Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

    Action

    Access level

    Resource type

    Condition key

    Dependent action

    ecs:EnableDiskEncryptionByDefault

    none

    *All Resource

    *

    		 None None

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    RegionId

    string

    Yes

    The region ID. You can call DescribeRegions to query the most recent region list.

    cn-hangzhou

    Response elements

    Element

    Type

    Description

    Example

    object

    Schema of Response。

    RequestId

    string

    The request ID.

    473469C7-AA6F-4DC5-B3DB-A3DC0DE3C83E

    Examples

    Success response

    JSON format

    {
  "RequestId": "473469C7-AA6F-4DC5-B3DB-A3DC0DE3C83E"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    400 InvalidParameter.Encrypted.KmsNotEnabled KMS must be enabled for encrypted disks. KMS is not activated. You must activate KMS before you can encrypt disks.
    400 InvalidParameter.KmsNotEnabled The operation failed because KMS is not activated. Please activate KMS in the KMS console and try again.
    403 Abs.InvalidAction.RegionNotSupport This region does not support this action. The operation is not supported in the region.
    403 InvalidOperation.DefaultEncryptionAlreadyEnabled The specified region is already default encryption settings. The region has enabled cloud disk encryption by default.
    403 InvalidParameter.RegionIdNotExists The specified region does not exist.
    403 InvalidParameter.KMSKeyId.KMSUnauthorized ECS service does not have permission to access your KMS key. Please verify that the specified KMS key has authorized the ECS service.
    403 InvalidOperation.KMSKeyIdNotFound The specified KMSKeyId does not exist. Please verify that the key ID is correct and that the key resides in the current region.
    403 InvalidOperation.KMSServiceNotOpen KMS service is currently not open. The KMS service has not been enabled.
    403 UserNotInTheWhiteList The user is not in disk white list. You are not authorized to manage the disk. Try again when you are authorized.
    403 InvalidParameter.KMSKeyId.CMKNotEnabled The specified KMS key must be in an enabled state. Please enable the key in the KMS console and try again.
    403 InvalidParameter.KMSKeyId.CMKUnauthorized The specified KMS key is not authorized for the ECS service. Please grant the ECS service permission to use the key in the KMS console and try again.

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.