6

In my scenario, I have some old EBS volumes that are not encrypted. To satisfy new corporate security measures, all data needs to be encrypted so I need to compile a plan to encrypt the unencrypted in the least disruptive way (Ideally with no downtime)?

Can anyone suggest What is the best way to accomplish this?

Improve this question

2 Answers 2

Reset to default
6

Here are the steps to encrypt EBS volume:

  • Create IAM KMS encryption key
  • Create snapshot of the root volume
  • Copy a snapshot which enables the encrypting option
  • Create a new Encrypted volume from an encrypted snapshot
  • Detach the existing volume and replace it with the Encrypted volume

For more information you can read this article.

Improve this answer
8
  • just to understand, Click on the unencrypted snapshot, pull down to copy, and click the encrypt button to encrypt the copy. stop the instance & Detach the existing volume and replace it with the Encrypted volume right?
    – samtech 2021
    Apr 4, 2022 at 6:34
  • @samtech2021, yes, from snapshot you can create encrypted volume.
    – Romeo Ninov
    Apr 4, 2022 at 6:47
  • 1
    Just to be pedantic, is there any procedure to perform it with no downtime (Unencrypt EBS volumes to be Encrypted)? What is the advice for more than 100 of EBS volumes to perform the task?
    – samtech 2021
    Apr 4, 2022 at 6:55
  • 1
    @samtech2021, AFAIK no. I do this research some time ago (was on similar situation). But if your machines are behind a loadbalancer you can create new EC2 with encrypted disk, start it, attache to LB, then deattach old one.
    – Romeo Ninov
    Apr 4, 2022 at 7:02
  • 1
    There does not appear to be a way to do this without downtime. For more than 100 EBS volumes, you could script the process because every step can be performed using the APIs.
    – Tim P
    Apr 4, 2022 at 14:46
0

It can be done but it is convoluted. Root volumes can be replaced on a running instance using a snapshot or an image. If you create a snapshot from a newly encrypted volume, however, it will result in an error. But, you can make an image from that snapshot and then the root volume can be replaced without stopping the instance. Here are the steps:

  1. Create a snapshot of the unencrypted volume

  2. Create a volume from the snapshot and add the encryption key. IMPORTANT: root device name must be the same. ie: /dev/xvda

  3. Create a new snapshot from the encrypted volume

  4. Create an image from the encrypted snapshot

  5. Replace root volume with new image: Actions > Monitor and troubleshoot > Replace root volume

One thing to note is that you can't change encryption keys with this method, only add one. To change it, the instance must be stopped.

Some useful tips:

  • keep track of ids

  • use tags and descriptions to keep track.

  • make sure snapshots and volumes have finished and are available.

  • make sure new image has same settings as the original instance.

More info here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/replace-root.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .