You can create an encrypted image using an encrypted ECS or an external image file.
When you use an encrypted ECS system disk to create a private image, the created private image is also encrypted. The key used for encrypting the image is the one used for creating the system disk. For details, see Creating a System Disk Image Using a Windows ECS and Creating a System Disk Image Using a Linux ECS.
When you use an external image file that has been uploaded to an OBS bucket to create a private image, you can select KMS encryption and the key when registering the image to encrypt the image. For details, see Creating a Windows System Disk Image Using an External Image File and Creating a Linux System Disk Image Using an External Image File.