Encrypted EBS Volumes with KMS key, sharing with other AWS accounts
Tags: devops, aws, cloud, linux
Published: 2022-06-07 02:49:01

**Background**
I needed to unencrypt an Amazon Elastic Block Store (Amazon EBS) volume that was encrypted using a default AWS Key Management Service (KMS) key aws/ebs or a custom KMS key. 

**Use Case**
I copied an encrypted ebs volume to a new, unencrypted ebs volume using a temporary/rescue linux EC2 instance, located in the same account as the KMS key used to encrypt the data. I then took snapshots and grants the other AWS account access to them using their AWS account ID. 

**Architecture**
A single AWS Account, not using AWS organizations 

**Lets Build**
- This first step is super important, before you do anything, create a snapshot of the encrypted volume, this will create a backup just in the event you make a mistake or have some unplanned data loss or corruption. 

- Open the Amazon EC2 console.

- Stop the instance with the encrypted root volume, take a note of where the instance is launched such as US-WEST-2

- Actions, Detach Volume, and then choose Yes, Detach

- We will Launch a new temporary linux, I prefer to use an AWS Linux AMI instance in the same Availability Zone as the original instance we stopped above.

- Once are new temp instance launches, choose Volumes from the navigation pane, and then select the detached, encrypted root volume.

- Choose Actions, Attach Volume, we need to attach the encrypted volume at either /dev/xvdf or /dev/sdg.

- Next, we will create a new, unencrypted volume in the same Availability Zone as the encrypted volume, in my case its US-WEST-1. I like to make these new, encrypted volumes a little bigger than the original encrypted volumes, such as 100GB larger for example. 

- We will attach the new, unencrypted volume to the new temp linux instance as /dev/xvdg or /dev/sdg for example. 

- At this point, the new, temp linux instance should have three ebs volumes, the root aws instance ebs volume, the encrypted ebs volume using KMS, and the new encrypted ebs volume we will copy data to using dd. 

- Connect to the new temp linux EC2 instance using SSH or AWS System Manager, session manager which is always my preference. 

- Once we are connected, we will issue the command below to confirm we have the volumes attached correctly. 

```
$lsblk
NAME    MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
```

```
$lsblk
NAME    MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
xvda    202:0    0   20G  0 disk 
└─xvda1 202:1    0   20G  0 part /
xvdf    202:80   0   40G  0 disk 
└─xvdf1 202:81   0   40G  0 part 
xvdg    202:96   0   50G  0 disk

```

Note: If you are only seeing a disk and not a partition, we will need to create one. 

_Creating Disk Partitions with Parted in Linux_

- Make sure its installed by running sudo parted and ready to roll if not, see below. To exit, invoke the command quit.


```
$ sudo yum install -y parted
Or
$ sudo dnf install -y parted

```

_List Existing Disk Partitions_

```
$ sudo parted -l

```

_To create a separate partition, First, select the target disk_

```
$ sudo parted /dev/sdp
```

or 

```
(parted) select /dev/sdp

```

_Next, we create a partition table using the mklabel command_

```
(parted) mklabel gpt

```

Note: You’ll get a  warning that the existing disk label will be destroyed and all the data deleted. Just type ‘Yes’ and hit ENTER.

_Creat Partition_

```
(parted) mkpart

```

Next, select your preferred partition type, we selected primary.

You will be prompted to provide a filesystem type we decided to go with ext4.

We will create a partition size of 50GB.

For the start value, select 1. For the end value, we will type in 50000 to represent 50000MB which is the equivalent of 50GB. 

_Format new partition_

```
$ sudo mkfs.ext4 /dev/sdp
```

_Copying Process_

As the root user, we will use the dd command to move the data from the original, encrypted volume /dev/sdg) to the new, unencrypted volume /dev/sdp).

```
#dd if=/dev/sdg of=/dev/sdp bs=4096 status=progress

```

Once the copy completes, we will detach the new, unencrypted volume (/dev/sdp) from the temp linux instance. Then, attach the volume to the original instance as /dev/xvda or /dev/sda1

Note: It's also a good time to create a snapshot of the new encrypted volume so you have a backup and wont need to go through another copy process using dd.