An elastic computing system, comprising: a first set of servers having stored thereon an unencrypted object storage representation of data of a block storage volume; a second set of servers configured to store an encrypted block representation of the block storage volume, wherein the second set of servers is configured with computer-executable instructions to handle user reads from and writes to blocks of the block storage volume via the encrypted block representation of the block storage volume; and a third set of servers in data communication with the first set of servers and the second set of servers, the third set of servers configured with computer-executable instructions to: receive the unencrypted object storage representation of blocks of the block storage volume from the first set of servers, receive an encryption context identifying an encrypted key to use for encrypting the block storage volume, store the encryption context in persistent memory on the third set of servers, access a decrypted key representing decrypted contents of the encrypted key, store the decrypted key on the third set of servers for use in encrypting the block storage volume, encrypt the blocks of the block storage volume using the decrypted key to generate the encrypted block representation of the block storage volume, and send the encrypted block representation of the block storage volume to the second set of servers; wherein the third set of servers is inaccessible for the user reads from or writes to blocks of the block storage volume; and wherein the encryption context and decrypted key are inaccessible to the second set of servers handling the user reads from and writes to blocks of the block storage volume. a first set of servers having stored thereon an unencrypted object storage representation of data of a block storage volume; a second set of servers configured to store an encrypted block representation of the block storage volume, wherein the second set of servers is configured with computer-executable instructions to handle user reads from and writes to blocks of the block storage volume via the encrypted block representation of the block storage volume; and a third set of servers in data communication with the first set of servers and the second set of servers, the third set of servers configured with computer-executable instructions to: receive the unencrypted object storage representation of blocks of the block storage volume from the first set of servers, receive an encryption context identifying an encrypted key to use for encrypting the block storage volume, store the encryption context in persistent memory on the third set of servers, access a decrypted key representing decrypted contents of the encrypted key, store the decrypted key on the third set of servers for use in encrypting the block storage volume, encrypt the blocks of the block storage volume using the decrypted key to generate the encrypted block representation of the block storage volume, and send the encrypted block representation of the block storage volume to the second set of servers; wherein the third set of servers is inaccessible for the user reads from or writes to blocks of the block storage volume; and wherein the encryption context and decrypted key are inaccessible to the second set of servers handling the user reads from and writes to blocks of the block storage volume. receive the unencrypted object storage representation of blocks of the block storage volume from the first set of servers, receive an encryption context identifying an encrypted key to use for encrypting the block storage volume, store the encryption context in persistent memory on the third set of servers, access a decrypted key representing decrypted contents of the encrypted key, store the decrypted key on the third set of servers for use in encrypting the block storage volume, encrypt the blocks of the block storage volume using the decrypted key to generate the encrypted block representation of the block storage volume, and send the encrypted block representation of the block storage volume to the second set of servers; wherein the third set of servers is inaccessible for the user reads from or writes to blocks of the block storage volume; and wherein the encryption context and decrypted key are inaccessible to the second set of servers handling the user reads from and writes to blocks of the block storage volume.