Aggregate encryption with S3 bucket volumes

[kombayn]

Hello. I'm planning to enable NAE on my aggregates, but I have one which is keeping Flex Group volumes for Fabric Pool S3 bucket. Can such volumes be encrypted? Should I use normal procedure? I mean - encrypt them with NVE and then move them within the aggregate with '-encrypt-with-aggr-key true ' argument?

[Ontapforrum · Accepted solution]

According to the following documents, Yes.  I think you can first - Enable NAE on the aggregates (containing existing FGs) & then use 'vol move start' to move them.

Can volume encryption be enabled on FlexGroup?
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/Can_volume_encryption_be_enabled_on_FlexGroup#:~:text=ONTAP%209%20Answ...

Enable encryption on an existing volume with the volume move start command
https://docs.netapp.com/us-en/ontap/encryption-at-rest/encrypt-existing-volume-task.html

Note: ONTAP 9.6 added NetApp Aggregate Encryption (NAE), which allows you to encrypt at the aggregate level. FlexGroup volumes can use NAE, provided all aggregates that contain member volumes belonging to the same FlexGroup volume are encrypted.

Are NetApp SnapLock software and NetApp ONTAP FlexGroup volumes compatible with NVE and NAE?
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/Are_NetApp_SnapLock_software_and_NetApp_ONTAP_FlexGroup_volumes_compat....

What are the restrictions with FlexGroup volumes and NAE?
https://kb.netapp.com/Advice_and_Troubleshooting/Data_Storage_Software/ONTAP_OS/What_are_the_restrictions_with_FlexGroup_volumes_and_NAE