diff --git a/pkg/apis/encrypt.go b/pkg/apis/encrypt.go
index e0b90290b4..284545ff53 100644
--- a/pkg/apis/encrypt.go
+++ b/pkg/apis/encrypt.go
@@ -33,10 +33,10 @@ type EncryptedResourceCreateInput struct {
 	// 新建密钥算法
 	EncryptKeyAlg *string `json:"encrypt_key_alg"`
 
-	// 加密秘钥的ID
+	// 加密密钥的ID
 	EncryptKeyId *string `json:"encrypt_key_id"`
 
-	// 加密蜜月的用户ID
+	// 加密密钥的用户ID
 	EncryptKeyUserId *string `json:"encrypt_key_user_id"`
 }
 
diff --git a/pkg/cloudcommon/db/encrypted.go b/pkg/cloudcommon/db/encrypted.go
index ad172e7b14..6096d4816e 100644
--- a/pkg/cloudcommon/db/encrypted.go
+++ b/pkg/cloudcommon/db/encrypted.go
@@ -19,6 +19,7 @@ import (
 	"time"
 
 	"yunion.io/x/jsonutils"
+	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/reflectutils"
 	"yunion.io/x/pkg/util/timeutils"
@@ -91,11 +92,12 @@ func (manager *SEncryptedResourceManager) ValidateCreateData(
 func (res *SEncryptedResource) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, data jsonutils.JSONObject, nameHint string) error {
 	if len(res.EncryptKeyId) == 0 && jsonutils.QueryBoolean(data, "encrypt_key_new", false) && !jsonutils.QueryBoolean(data, "dry_run", false) {
 		// create new encrypt key
-		session := auth.GetSession(ctx, userCred, consts.GetRegion(), "v1")
+		session := auth.GetAdminSession(ctx, consts.GetRegion(), "v1")
 		now := time.Now()
 		keyName := "key-" + nameHint + "-" + timeutils.ShortDate(now)
 		algName, _ := data.GetString("encrypt_key_alg")
-		secret, err := identity_modules.Credentials.CreateEncryptKey(session, ownerId.GetUserId(), keyName, algName)
+		userId, _ := data.GetString("encrypt_key_user_id")
+		secret, err := identity_modules.Credentials.CreateEncryptKey(session, userId, keyName, algName)
 		if err != nil {
 			return errors.Wrap(err, "Credentials.CreateEncryptKey")
 		}
@@ -114,27 +116,28 @@ func (manager *SEncryptedResourceManager) FetchCustomizeColumns(
 ) []apis.EncryptedResourceDetails {
 	rets := make([]apis.EncryptedResourceDetails, len(objs))
 
-	session := auth.GetAdminSession(ctx, consts.GetRegion(), "")
-	encKeys, err := identity_modules.Credentials.GetEncryptKeys(session, userCred.GetUserId())
-	if err != nil {
-		return rets
-	}
+	session := auth.GetSession(ctx, userCred, consts.GetRegion(), "")
 	encKeyMap := make(map[string]identity_modules.SEncryptKeySecret)
-	for i := range encKeys {
-		encKeyMap[encKeys[i].KeyId] = encKeys[i]
-	}
 	for i := range objs {
 		var base *SEncryptedResource
 		reflectutils.FindAnonymouStructPointer(objs[i], &base)
 		if base != nil && len(base.EncryptKeyId) > 0 {
-			if encKey, ok := encKeyMap[base.EncryptKeyId]; ok {
-				rets[i].EncryptKey = encKey.KeyName
-				rets[i].EncryptAlg = string(encKey.Alg)
-				rets[i].EncryptKeyUser = string(encKey.User)
-				rets[i].EncryptKeyUserId = string(encKey.UserId)
-				rets[i].EncryptKeyUserDomain = string(encKey.Domain)
-				rets[i].EncryptKeyUserDomainId = string(encKey.DomainId)
+			encKey, ok := encKeyMap[base.EncryptKeyId]
+			if !ok {
+				secKey, err := identity_modules.Credentials.GetEncryptKey(session, base.EncryptKeyId)
+				if err != nil {
+					log.Errorf("fail to fetch enc key %s: %s", base.EncryptKeyId, err)
+					continue
+				}
+				encKey = secKey
+				encKeyMap[base.EncryptKeyId] = secKey
 			}
+			rets[i].EncryptKey = encKey.KeyName
+			rets[i].EncryptAlg = string(encKey.Alg)
+			rets[i].EncryptKeyUser = string(encKey.User)
+			rets[i].EncryptKeyUserId = string(encKey.UserId)
+			rets[i].EncryptKeyUserDomain = string(encKey.Domain)
+			rets[i].EncryptKeyUserDomainId = string(encKey.DomainId)
 		}
 	}
 	return rets
diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go
index 5e45b08bbb..74fa857c51 100644
--- a/pkg/compute/models/guest_actions.go
+++ b/pkg/compute/models/guest_actions.go
@@ -873,6 +873,12 @@ func (self *SGuest) StartResumeTask(ctx context.Context, userCred mcclient.Token
 func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
 	data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
 	if utils.IsInStringArray(self.Status, []string{api.VM_READY, api.VM_START_FAILED, api.VM_SAVE_DISK_FAILED, api.VM_SUSPEND}) {
+		if self.IsEncrypted() {
+			_, err := self.GetEncryptInfo(ctx, userCred)
+			if err != nil {
+				return nil, errors.Wrap(err, "GetEncryptInfo")
+			}
+		}
 		if !self.guestDisksStorageTypeIsShared() {
 			host, _ := self.GetHost()
 			guestsMem, err := host.GetNotReadyGuestsMemorySize()