Is it possible to create an encrypted ebs boot volume for a windows ec2 instance?

This AWS example shows how to copy an unencrypted boot volume, creating an encrypted boot volume: aws ec2 copy-image -r us-east-1 -s ami-60b6c60a --encrypted --kmsKeyID arn:aws:kms:us-east-1:012345678910:key/abcd1234-a123-456a-a12b-a123b4cd56ef

However, when I try this with the Microsoft Windows Server 2012 R2 Base - ami-c8a9baa2 as the source using aws ec2 copy-image --source-region us-east-1 --source-image-id ami-c8a9baa2 --name 'W12R2_Base_encrypted' --description 'Microsoft Windows Server 2012 R2 Base - ami-c8a9baa2 (encrypted)' --encrypted, I get the error: "A client error (InvalidRequest) occurred when calling the CopyImage operation: Images with EC2 BillingProduct codes cannot be copied to another AWS account."


You first need to create your own private AMI based on this Marketplace AMI. The "BillingProduct" part of the error is the main clue.

In more detail:

  1. Launch an instance with this marketplace AMI. [optionally, you can login and modify it.]
  2. Use this newly launched instance to create your own private AMI (Create Image)
  3. Copy this image and check the Encryption box. Using the CLI, you would use the copy-image mode with the --encrypted flag.

More info: http://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/Creating_EBSbacked_WinAMI.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.