Which types of NetApp Encryption are supported with the cloud provider's key vault with NetApp Cloud Volumes ONTAP?

Cloud Volumes ONTAP can use the cloud-provider native key-management services (AWS KMS, Azure Key Vault, Google Cloud KMS) only for NetApp Volume Encryption (NVE). When NVE is enabled, each volume is encrypted with its own XTS-AES-256 key that is wrapped and stored in the provider’s key vault. Aggregate-level encryption (NAE), Onboard Key Manager (OKM), and application-level TDE are not integrated with the cloud key vault in CVO.

A. TDE – Database-level encryption; unrelated to NetApp or cloud key-vault integration.

B. OKM – Hardware/cluster-resident; not used in CVO and cannot leverage the cloud provider’s key vault.

C. NAE – Not supported on Cloud Volumes ONTAP; therefore cannot use the provider’s key vault.

1. NetApp Documentation: “Security and data encryption for Cloud Volumes ONTAP,” section ‘Data encryption’ – states “Cloud Volumes ONTAP supports NetApp Volume Encryption (NVE)… NetApp Aggregate Encryption (NAE) is not supported.” (docs.netapp.com/us-en/occm/conceptsecurity.html)

2. NetApp ONTAP 9 Encryption Power Guide, §4.3 “Cloud Volumes ONTAP support” – confirms NVE with external KMS; NAE unsupported. (ONTAP 9.12.1 Doc ID 215-16025A0, pp. 32-33)

3. TR-4569 “NetApp Volume Encryption,” §5 “Deployment in Cloud Volumes ONTAP” – details integration with AWS KMS/Azure Key Vault/GCP KMS for NVE only. (https://www.netapp.com/media/17229-tr4569.pdf, p. 15)