5

In my scenario, I have some old EBS volumes that are not encrypted. To satisfy new corporate security measures, all data needs to be encrypted so I need to compile a plan to encrypt the unencrypted in the least disruptive way (Ideally with no downtime)?

Can anyone suggest What is the best way to accomplish this?

1 Answer 1

5

Here are the steps to encrypt EBS volume:

  • Create IAM KMS encryption key
  • Create snapshot of the root volume
  • Copy a snapshot which enables the encrypting option
  • Create a new Encrypted volume from an encrypted snapshot
  • Detach the existing volume and replace it with the Encrypted volume

For more information you can read this article.

8
  • just to understand, Click on the unencrypted snapshot, pull down to copy, and click the encrypt button to encrypt the copy. stop the instance & Detach the existing volume and replace it with the Encrypted volume right? Apr 4 at 6:34
  • @samtech2021, yes, from snapshot you can create encrypted volume. Apr 4 at 6:47
  • 1
    Just to be pedantic, is there any procedure to perform it with no downtime (Unencrypt EBS volumes to be Encrypted)? What is the advice for more than 100 of EBS volumes to perform the task? Apr 4 at 6:55
  • 1
    @samtech2021, AFAIK no. I do this research some time ago (was on similar situation). But if your machines are behind a loadbalancer you can create new EC2 with encrypted disk, start it, attache to LB, then deattach old one. Apr 4 at 7:02
  • 1
    There does not appear to be a way to do this without downtime. For more than 100 EBS volumes, you could script the process because every step can be performed using the APIs.
    – Tim P
    Apr 4 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.