The city wants Object Storage buckets for permit PDFs encrypted with a customer-managed Vault master key. How do integrated OCI services use that key?
Select an answer to reveal the explanation.
Short Explanation
You hand the service a permission slip for your master key; the service asks Vault to wrap and unwrap data keys and never needs you to paste a plaintext DEK into the bucket.
Full Explanation
Integrated services including Object Storage, Block Volume, File Storage, Streaming with a customer-managed key on a pool, and OKE cluster encryption of Kubernetes secrets use Vault to wrap and unwrap keys. You grant the service rights to use the master key (often via association or key-delegate). You do not supply the plaintext DEK to the bucket.