# Encryption at Rest - Storage Services
![`smart`](CloudVendorEncryption_en_001_20231008.png)
+ Block storage uses the volume encryption feature offered by AWS/GCP
+ Object storage uses the bucket server-side encryption feature provided by AWS/GCP
------------------------------------------------------------------------------
All stored data, including database tables, indexes, TiDB cluster metadata, info logs, WAL logs and backup files, are encrypted automatically using AES-256.

TiDB Cloud automatically encrypts the data stored in both TiDB Dedicated and TiDB Serverless clusters.

TiDB clusters in TiDB Cloud use two types of storage services provided by underlying cloud infrastructure providers: Non-local block storage such as EBS (Elastic Block Store), object storage like S3 (Simple Storage Service) and GCS (Google Cloud Storage). 

Data stored in TiKV (distributed key-value store), TiFlash (distributed analytical storage), as well as logs and backups, are subsequently stored in the underlying block device and object storage services offered by AWS (Amazon Web Services) and GCP (Google Cloud Platform). 

When TiDB Cloud writes data, such as transaction changes, logs, backups, etc., it guarantees automatic encryption for block storage at volume level and object storage at object (file) level. To use a symmetric data encryption key, TiDB Cloud simply writes data to storage services provided by AWS or GCP, such as S3, EBS, GCS, etc. These integrated storage services, in turn, interact with key management services. Consequently, TiDB Cloud does not have any interaction with the master keys or the data encryption keys.

For object storage, TiDB Cloud uses server-side encryption on Amazon S3 and GCS provided by AWS/GCP.

For block storage, TiDB Cloud uses volume encryption feature provided by AWS/GCP.

The data encryption algorithm the TiDB Cloud uses is AES-256 for both block storage and object storage. 

Please register for the free self-paced e-learning course "TiDB Essentials for DBA" on `https://www.pingcap.com/education/` to gain a deeper understanding of write-ahead logs (WAL logs).