How to get details of an AMI or Snapshot if It is encrypted and with which key (AWS Managed CMK or Customer Manager CMK)- AWS
Tags: linux, aws, devops
Published: 2020-01-21 17:44:20

**Issue** :
➜ I want to get information about my AMI to know if it is Encrypted or not and If yes, then with which key it is encrypted with (AWS Managed CMK or Customer Manager CMK) so that I can utilize this information while sharing my AMI with another account without any issues.

**Solution**
➜ We can get this information using AWS Console as well as AWS CLI which could be useful while troubleshooting Encrypted AMI/Snapshots and KMS co-relation

<p><span style="color: rgb(68, 68, 68); font-weight: 700;"><u><b>How can I check using AWS CLI Commands</u></b>:</span></p>
<p><span style="color: rgb(68, 68, 68);">You can use below APIs to get the information :</span></p>
<ul>
    <li>
        <font color="#444444"><b><a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html" target="_blank">describe-images</a></b>
            <a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-images.html" target="_blank"> </a>( this can be used to get the <b>block devices information</b> of the AMI which also provides you a <b>snapshot&nbsp;id</b>&nbsp; associated with that device).</font>
    </li>
    <li>
        <font color="#444444"><b><a href="https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html" target="_blank">describe-snapshots</a> </b>(this can be used to get the information about each snapshot in order to get the encryption parameter <b>"true"</b>            or <b>"false"</b> and the corresponding keyid)</font>
    </li>
    <li>
        <font color="#444444"><b><a href="https://docs.aws.amazon.com/cli/latest/reference/kms/describe-key.html" target="_blank">describe-key</a></b> ( if the snapshot is encrypted , you can check the details of the Key whether it is <b>"AWS Managed CMK" </b>or <b>"Customer Manager CMK"</b>            )<br></font>
    </li>
</ul>
<p><br></p>
<p><b><u>Example:</u></b></p>
<p><i>I want to get the details of My AMI (ami-0xxxxxx) located in region (eu-west-1). I would like to know if this AMI is encrypted and if yes, then which keys are being used for Encryption so that I can decide further on allowing&nbsp;access to other&nbsp;accounts to use it.</i></p>
<p><br></p>
<p><b>[1] </b>Checking AMI Block Mappings to See Snapshots associated&nbsp; :</p>
<pre style="line-height:normal"><font color="#232f3e" face="Helvetica, sans-serif"><span style="font-size: 14px;"> # aws ec2 describe-images --image-ids ami-0xxxxxx --region eu-west-1 --query "Images[*].BlockDeviceMappings" 
[
    [
        {
            "DeviceName": "/dev/xvda",
            "Ebs": {
                "DeleteOnTermination": true,
                "SnapshotId": "snap-xxxxxxxxxxxxx",
                "VolumeSize": 8,
                "VolumeType": "gp2",
                "Encrypted": true
            }
        }
    ]
]
</span><span style="font-size: 14px;">
</span></font></pre>

<p><b>[2]</b> Checking Snapshots details to find the key and encryption details&nbsp; :</p>
<pre style="line-height:normal"><font color="#232f3e" face="Helvetica, sans-serif"><span style="font-size: 14px;"> # aws ec2 describe-snapshots --snapshot-ids "snap-xxxxxxxxxxxxx"  --region eu-west-1
{
    "Snapshots": [
        {
            "Description": "Copied for DestinationAmi ami-0xxxxxx from SourceAmi ami-. Task created on 1,579,611,950,318.",
            "Encrypted": true,
            "KmsKeyId": "arn:aws:kms:eu-west-1:xxxxxxxxxxxx:key/dcd4xxxxxxxxxxxxxxxxxx",
            "OwnerId": "xxxxxxxxxxxx",
            "Progress": "100%",
            "SnapshotId": "snap-xxxxxxxxxxxxx",
            "StartTime": "2020-01-21T13:05:53.887Z",
            "State": "completed",
            "VolumeId": "vol-ffffffff",
            "VolumeSize": 8
        }
    ]
}
</span><span style="font-size: 14px;">
</span></font></pre>

<p><b>[3] </b>Now, Checking If its encrypted using AWS Managed Key or Customer Managed Key: </p>
<pre style="line-height:normal"><font color="#232f3e" face="Helvetica, sans-serif"><span style="font-size: 14px;"> # aws kms describe-key --key-id "dcd4dcd4xxxxxxxxxxxxxxxxxx"  --region eu-west-1
{
    "KeyMetadata": {
        "AWSAccountId": "xxxxxxxxxxxx",
        "KeyId": "dcd4dcd4xxxxxxxxxxxxxxxxxx",
        "Arn": "arn:aws:kms:eu-west-1:xxxxxxxxxxxx:key/dcd4dcd4xxxxxxxxxxxxxxxxxx",
        "CreationDate": 1579611763.538,
        "Enabled": true,
        "Description": "02-ratheed-CMK",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "KeyState": "Enabled",
        "Origin": "AWS_KMS",
        "KeyManager": "CUSTOMER",
        "CustomerMasterKeySpec": "SYMMETRIC_DEFAULT",
        "EncryptionAlgorithms": [
            "SYMMETRIC_DEFAULT"
        ]
    }
}
</span><span style="font-size: 14px;">
</span></font></pre>


<p><u style="color: rgb(68, 68, 68); font-weight: 700;"> <b>How can I check using AWS Console</b></u><span style="color: rgb(68, 68, 68); font-weight: 700;">:</span><br></p>
<ul>
    <li>Go to AWS Console - EC2 - Navigate to Images section and click "AMIs" or Click <b><a href="https://console.aws.amazon.com/ec2/v2/home?#Images:sort=name" target="_blank">here</a></b></li>
    <li>Copy the AMI id whose information you would like to know.</li>
    <li>Navigate to "Elastic Block Store" and Navigate to "Snapshots" page or click <b><a href="https://console.aws.amazon.com/ec2/v2/home?#Snapshots:visibility" target="_blank">here </a></b>and you can paste the AMI id in the search box available which you've
        copied (it will show you the associated Snapshots for this AMI )</li>
    <li>To know the Snapshot Encryption Status check Description below and you will find details such as :</li>
</ul>
<p>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Encryption&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:&nbsp; &nbsp;<b> Encrypted</b></p>
<p>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;KMS Key ID&nbsp; &nbsp; &nbsp; :&nbsp; &nbsp;<b>dcd4dxxxxxxxxxx</b></p>
<p>&nbsp; &nbsp; &nbsp; &nbsp; KMS Key ARN :&nbsp; &nbsp;<b>arn:aws:kms:eu-west-1:920ssss:key/dcd4dxxxxxxxxxx</b></p>

<p><b> ➜It means the AMI is Encrypted (means have Encrypted Snapshot) with a Key id (dcd4dxxxxxxxxxx) - And you can make a note of this to check the Key Type further.</b></p>

<p><b><i>&lt;&lt; Now, we don't have the details about the Key whether it is (AWS Managed CMK or Customer Manager CMK) &gt;&gt;</i></b><br></p>
<p><b><i>To find out this , Please follow below steps:</i></b></p>
<p>- Go to AWS Console - <b><a href="https://console.aws.amazon.com/kms/home?#/kms/home" target="_blank">KMS </a></b>- and there on the left hand side you have all the keys available:<br></p>
<ul>
    <li>&nbsp; &nbsp; <b>AWS managed keys</b></li>
    <li>&nbsp; &nbsp; <b>Customer managed keys</b></li>
</ul>
<p>➜ Now, you can click on one of the above choices to filter for the Key Id which you have noted above in below to verify the type of key whether it is (AWS Managed CMK or Customer Manager CMK).</p>
<p><br></p>

<p> <b>Now, you can use above information for further use such as sharing this AMI with another account</p></b>
<p><br></p>
<p><span style="color: rgb(68, 68, 68);"><span style="font-weight: 700;">**Please Note**</span></span>
</p>
<p><span style="color: rgb(68, 68, 68);"> ➜You can't share the AMIs which are encrypted with AWS Managed Key (which is the aws default key to encrypt) which is also documented here:</span></p>
<p>
    <font color="#444444"><b>[+] Considerations :</b>&nbsp;</font><a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html#share-snapshot-considerations">https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-modifying-snapshot-permissions.html#share-snapshot-considerations</a></p>
<p><br></p>

<p>Also, To know more on "Customer Managed CMKs" &amp; "AWS Managed CMKs" , please refer :<br></p>
<p><span style="font-weight: 700;"><font color="#444444"><b>[+] AWS Key Management Service Concepts :&nbsp;</span><a href="https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html">https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html</a></p>
<p><br></p>

<p><br></p>
<p><br></p>