Home / OCI

OCIRunbookAdvanced

Sev1: OCI Vault master key disabled or scheduled for deletion — volumes, buckets and databases inaccessible

Restore access to block volumes, Object Storage buckets and databases encrypted with a customer-managed OCI Vault key that was disabled or scheduled for deletion. Cancel deletion, re-enable the key, fix IAM, find who did it.

Deepak Bhardwaj2 min read

Applies toOCI Vault (KMS) customer-managed keys, Block Volume, Object Storage, Autonomous and Base Database, OCI CLI 3.x

Symptoms

  • Block volumes or boot volumes fail to attach or instances fail to start after a reboot.
  • Object Storage returns errors for objects in buckets encrypted with your key.
  • Autonomous Database becomes inaccessible; Base Database TDE wallet operations fail.

1. Find the key and its state

VAULT=<vault-ocid>
MGMT=$(oci kms management vault get --vault-id $VAULT --query 'data."management-endpoint"' --raw-output)

oci kms management key list --compartment-id $C --endpoint $MGMT \
  --query 'data[].{name:"display-name", id:id, state:"lifecycle-state"}' --output table

oci kms management key get --key-id $KEY --endpoint $MGMT \
  --query 'data.{state:"lifecycle-state", deletion:"time-of-deletion", protection:"protection-mode"}'
lifecycle-state Action
DISABLED Enable (Step 3)
PENDING_DELETION Cancel deletion (Step 2), then it returns to its previous state
DELETED Key is gone; data encrypted only under it is unrecoverable

Check the vault too — a vault can be scheduled for deletion, which takes its keys with it:

oci kms management vault get --vault-id $VAULT --query 'data."lifecycle-state"'
oci kms management vault cancel-deletion --vault-id $VAULT

2. Cancel key deletion

oci kms management key cancel-deletion --key-id $KEY --endpoint $MGMT

Deletion has a waiting period (7–30 days, chosen when scheduled). You can only cancel within it.

3. Enable the key

oci kms management key enable --key-id $KEY --endpoint $MGMT

4. IAM: services must be allowed to use the key

If the key is fine but services still fail, a policy may have been removed. Services need permission to use keys:

Allow service blockstorage, objectstorage-eu-frankfurt-1 to use keys in compartment security where target.key.id = '<key-ocid>'
Allow dynamic-group 'Default'/'adb-dg' to use keys in compartment security

Service names and regional Object Storage principals follow a documented format — check the Vault documentation for each service.

5. Bring workloads back

  • Restart instances or re-attach volumes that failed.
  • Autonomous Database: check the console status; it should return to AVAILABLE once the key is usable.
  • Re-test Object Storage reads on encrypted buckets.

6. Who did it

oci audit event list --compartment-id $C --start-time 2026-10-17T00:00:00Z --end-time 2026-10-24T23:59:59Z \
  --query 'data[?contains("data"."event-name", `ScheduleKeyDeletion`) || contains("data"."event-name", `DisableKey`)].{t:"event-time", e:"data"."event-name", who:"data"."identity"."principal-name"}' --output table

Prevent it next time

  • Restrict manage keys / manage vaults to a security group; operators get use keys only.
  • Events rule on key and vault disable/delete events to Notifications → on-call.
  • Use the longest deletion waiting period, and tag keys with what they protect.
  • Back up keys (oci kms management key backup) where your protection mode allows.

Related fixes