feat(block): add doc on kms encryption

pages/block-storage/api-cli/encrypt-volumes-with-key-manager.mdx

@@ -0,0 +1,90 @@
+---
+title: Encrypting Block Storage volumes with Key Manager via the Scaleway API
+description: Learn how to encrypt Scaleway Block Storage volumes and their snapshots with a Key Manager key using the Block Storage API.
+tags: block storage volume encryption key-manager kms snapshot
+dates:
+  validation: 2026-10-15
+  posted: 2026-10-15
+---
+import Requirements from '@macros/iam/requirements.mdx'
+
+You can encrypt your Block Storage volumes with a [Key Manager](/key-manager/) key. When you create a volume with a Key Manager key, the key protects the encryption of the volume. You manage this key yourself, and can [disable](/key-manager/how-to/disable-km-keys/) or [delete](/key-manager/how-to/delete-km-keys/) it at any time.
+
+<Message type="important">
+Block Storage volume encryption with Key Manager is currently in Private Beta, and is only available via the [Block Storage API](https://www.scaleway.com/en/developers/api/block/volume#create-a-volume).
+</Message>
+
+<Requirements />
+
+- A Scaleway account logged into the [console](https://console.scaleway.com)
+- [Owner](/iam/concepts/glossary/#owner) status or [IAM permissions](/iam/concepts/glossary/#permission) allowing you to perform actions in the intended Organization
+- A valid [API key](/iam/credentials/create-api-keys/)
+- Access to the Block Storage encryption with Key Manager Private Beta
+- An existing [Key Manager key](/key-manager/how-to/create-km-key/) using [symmetric encryption](/key-manager/concepts/#symmetric-encryption) with the `AES-256-GCM` algorithm
+
+## Limitations
+
+- You can only encrypt additional volumes. You cannot encrypt boot volumes with a Key Manager key.
+- You can only set the Key Manager key when you create a volume.
+- You can only use symmetric encryption keys with the `AES-256-GCM` algorithm.
+- Snapshots of an encrypted volume use the same Key Manager key as their parent volume. Volumes created from these snapshots also use the same key, and you cannot choose a different key.
+- You cannot export a snapshot of an encrypted volume to an Object Storage bucket.
+
+<Message type="important">
+If you delete the Key Manager key used to encrypt a volume, you lose access to the volume and its snapshots once the volume is detached from its Instance. An attached volume remains readable, but you cannot reattach a detached volume or use its snapshots without the key.
+</Message>
+
+## Create an encrypted volume
+
+Run the following command to create an encrypted Block Storage volume. Replace the placeholders with the appropriate values, and adjust the `size` (in bytes) and `perf_iops` values as needed:
+
+```bash
+curl -X POST \
+  -H "X-Auth-Token: $SCW_SECRET_KEY" \
+  -H "Content-Type: application/json" \
+  "https://api.scaleway.com/block/v1/zones/<ZONE>/volumes" \
+  -d '{
+    "name": "my-encrypted-volume",
+    "project_id": "<PROJECT_ID>",
+    "perf_iops": 5000,
+    "from_empty": {
+      "size": 50000000000
+    },
+    "kms_key_id": "<KMS_KEY_ID>"
+  }'
+```
+
+The `kms_key_id` field of the response contains the ID of the Key Manager key protecting the volume.
+
+You can then [attach](/block-storage/how-to/attach-a-volume/) and [mount](/block-storage/how-to/mount-a-volume/) the encrypted volume like any other Block Storage volume. The Instance handles decryption, and you do not need any additional configuration.
+
+To check whether Key Manager encrypts a volume, run the following command. If the `kms_key_id` field is `null`, Key Manager does not encrypt the volume.
+
+```bash
+curl -X GET \
+  -H "X-Auth-Token: $SCW_SECRET_KEY" \
+  "https://api.scaleway.com/block/v1/zones/<ZONE>/volumes/<VOLUME_ID>"
+```
+
+## Create a snapshot of an encrypted volume
+
+Run the following command to create a snapshot of an encrypted volume. Replace the placeholders with the appropriate values:
+
+```bash
+curl -X POST \
+  -H "X-Auth-Token: $SCW_SECRET_KEY" \
+  -H "Content-Type: application/json" \
+  "https://api.scaleway.com/block/v1/zones/<ZONE>/snapshots" \
+  -d '{
+    "volume_id": "<VOLUME_ID>",
+    "name": "my-encrypted-snapshot",
+    "project_id": "<PROJECT_ID>"
+  }'
+```
+
+The snapshot uses the same Key Manager key as its parent volume. The `kms_key_id` field of the response contains the ID of this key.
+
+## Going further
+
+- See the [Block Storage API documentation](https://www.scaleway.com/en/developers/api/block/) for more information on volume and snapshot management.
+- See the [Key Manager documentation](/key-manager/) for more information on how to manage your keys.

pages/block-storage/menu.ts

@@ -88,6 +88,10 @@ export const blockStorageMenu = {
           label: 'Increasing volume size via the API',
           slug: 'increasing-volume-size',
         },
+        {
+          label: 'Encrypting volumes with Key Manager via the API',
+          slug: 'encrypt-volumes-with-key-manager',
+        },
       ],
       label: 'API/CLI',
       slug: 'api-cli',