EBS Volume encryption with AWS CLI using AWS Managed Key
Tags: ec2, awskey, ebs
Published: 2022-12-17 02:01:07

In my previous blog I have shown you how to do **[EBS Volume encryption with AWS Managed Key EC2 instance of a launched Cloud9 environment](https://dev.to/aws-builders/ec2-instance-of-a-launched-cloud9-environment-and-its-ebs-volume-encryption-with-aws-managed-key-3lk)**. 

In this article, I am going to show you how to do EBS Volume encryption with AWS Command Line Interface (CLI) using AWS Managed Key

For a detailed description on the EB2 volume encryption process, please visit my previous blog mentioned above.



_**Let’s get started!**_

Please visit my **[GitHub Repository for EBS articles](https://github.com/awsmine/EBS_projects)** on various topics being updated on constant basis.


# Objectives:

**1.** Create an AWS EC2 instance

**2.** Create a snapshot of the EBS volume

**3.** Copy snapshot (unencrypted) to an encrypted copy using AWS Managed Key

**4.** Create a new EBS volume from the encrypted snapshot in the same Availability Zone as your EC2 instance

**5.** Attach the new (encrypted) volume to the Amazon EC2 instance on a different device

**6.** Restart the encrypted EC2 instance


# Pre-requisites:
- AWS user account with admin access, not a root account.
- Cloud9 IDE with AWS CLI.
- Create an IAM role with **`AmazonEBSCSIDriverPolicy`** and **`AmazonEC2FullAccess`**


# Resources Used:

- Please visit my [previous blog on some of the CLI commands used for EC2 creation]( https://dev.to/aws-builders/ec2-web-server-with-apache-using-aws-cli-2gak).

- [EC2 CLI](https://docs.aws.amazon.com/cli/latest/reference/ec2/index.html#available-commands) 


# Steps for implementation to this project:

## 1. Create an AWS EC2 instance and login to EC2 Instance thru EC2 Connect

- Find an AMI

An Amazon Machine Image (AMI) is an image provided by AWS. It is
a template for the root volume of the instance (for example, an
operating system, an application server, and applications).

- On the AWS EC2 console/Instances/Launch an EC2 Instance/Under - Application and OS Images (Amazon Machine Image) - Amazon Linux AWS

- Copy Amazon Machine Image (AMI) ID


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jpxksansrriheofrjmmo.png)



- Find the EC2 Instance type

There are many instance types which are grouped together based on different compute, memory and storage capabilities. I have chosen t2.micro which is in free-tier.


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pimvr8lprtrptxddx1sx.png)

```
aws ec2 run-instances --image-id ami-0b5eea76982371e91 --count 1 --instance-type t2.micro --region us-east-1
```

- Take note of the instance ID 

- Instance ID - **`i-077af5f2ecb89c2ad`** name it as myec2

```
aws ec2 describe-instances 
   
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/szodxoeizl6tlavvocb2.png)

- To get the following values

**Note:**

**1.** Take note of the Device name - **`/dev/xvda`** 
**2.** Availability zone - **`us-east-1c`**
**3.** Volume ID - **`vol-0fb860db404da7a11`** name it as ec2-vol-unencrypt 

```
aws ec2 describe-instances \
    --instance-ids i-077af5f2ecb89c2ad
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xri2qmeywxa4evwkc1z1.png)



## 2. Create a snapshot of the EBS volume

- substitute the volume ID from step 1


```
aws ec2 create-snapshot  --volume-id vol-0fb860db404da7a11 --region us-east-1 --description "ec2-snap-unencrypt"
```

**Note:** 

**1.** SanpshotID - **`snap-026d48b0db0f94561`** name it as ec2-snap-unencrypt


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/atkzoukh0crajhoc0t77.png)



## 3. Copy snapshot (unencrypted) to an encrypted copy using AWS Managed Key

- Using SnapshotId from previous step as source, create an encrypted copy of the snapshot

ec2-snap-unencrypt =======> ec2-snap-encrypt

```
aws ec2 copy-snapshot \
 --source-region us-east-1 \
 --source-snapshot-id snap-026d48b0db0f94561 \
 --encrypted \
 --kms-key-id aws/ebs \
 --description "ec2-snap-encrypt"

```

- Wait till **Snapshot status:** shows - Completed

```
aws ec2 describe-snapshots \
    --snapshot-ids snap-0ffad4354d5eec3f4
```
**Note:**
**1.** ec2-snap-encrypt - **`snap-0ffad4354d5eec3f4`**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0e3u217v7tzom9shwu77.png)



## 4. Create a new EBS volume from the encrypted snapshot in the same Availability Zone as your EC2 instance

ec2-snap-encrypt =======> ec2-vol-encrypt

- Create a new volume from this encrypted snapshot with create-volume CLI. 

- The output of this command will give you the volume identifier which now can be used in place of the original unencrypted EBS volume.

```
aws ec2 create-volume \
    --region us-east-1 \
    --availability-zone us-east-1c \
    --snapshot-id snap-0ffad4354d5eec3f4 \
    --volume-type gp2 \
    --encrypted 
```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4nufqk7tk4az25k08x4h.png)


**Note:** ec2-vol-encrypt - **`vol-08e4cd64f0208e4f0`**


## 5. Attach the new (encrypted) volume to the Amazon EC2 instance on a different device

ec2-vol-encrypt =======> attach to EC2 Instance 

```
aws ec2 attach-volume --volume-id vol-08e4cd64f0208e4f0 --instance-id i-077af5f2ecb89c2ad --device /dev/xvdb

```

- to check encrypted ec2 volume, device type  

```
aws ec2 describe-instances \
    --filters "Name=tag-value,Values=myec2"

```


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o8p25kd2voprnjomelqy.png)



## 6. Restart the encrypted EC2 instance

To check that the EC2 is running fine after encryption

- Stop the EC2 encrypted instance 

```
aws ec2 stop-instances --instance-ids i-077af5f2ecb89c2ad

```

- Start the EC2 encrypted instance 

```
aws ec2 start-instances --instance-ids i-077af5f2ecb89c2ad

```

# Cleanup



- detach and delete ec2-vol-encrypt

```
aws ec2 detach-volume --volume-id vol-08e4cd64f0208e4f0


aws ec2 delete-volume --volume-id vol-08e4cd64f0208e4f0

```

- delete ec2-snap-unencrypt


```
aws ec2 delete-snapshot --snapshot-id snap-026d48b0db0f94561

```


- delete ec2-snap-encrypt

```
aws ec2 delete-snapshot --snapshot-id snap-0ffad4354d5eec3f4

```


- terminate EC2 Instance 


```
aws ec2 terminate-instances --instance-ids i-077af5f2ecb89c2ad

```

# What we have done so far

We have successfully demonstrated on how to do EBS Volume encryption with AWS Command Line Interface (CLI) using with AWS Managed Key.