docs.aws.amazon.com
Open in
urlscan Pro
18.66.139.49
Public Scan
Submitted URL: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default\n\nAdditional
Effective URL: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
Submission: On May 13 via api from US — Scanned from DE
Effective URL: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
Submission: On May 13 via api from US — Scanned from DE
Form analysis 0 forms found in the DOM
Text Content
SELECT YOUR COOKIE PREFERENCES
We use cookies and similar tools to enhance your experience, provide our
services, deliver relevant advertising, and make improvements. Approved third
parties also use these tools to help us deliver advertising and provide certain
site features.
CustomizeAccept all
CUSTOMIZE COOKIE PREFERENCES
We use cookies and similar tools (collectively, "cookies") for the following
purposes.
ESSENTIAL
Essential cookies are necessary to provide our site and services and cannot be
deactivated. They are usually set in response to your actions on the site, such
as setting your privacy preferences, signing in, or filling in forms.
PERFORMANCE
Performance cookies provide anonymous statistics about how customers navigate
our site so we can improve site experience and performance. Approved third
parties may perform analytics on our behalf, but they cannot use the data for
their own purposes.
Allow performance category
Allowed
FUNCTIONAL
Functional cookies help us provide useful site features, remember your
preferences, and display relevant content. Approved third parties may set these
cookies to provide certain site features. If you do not allow these cookies,
then some or all of these services may not function properly.
Allow functional category
Allowed
ADVERTISING
Advertising cookies may be set through our site by us or our advertising
partners and help us deliver relevant marketing content. If you do not allow
these cookies, you will experience less relevant advertising.
Allow advertising category
Allowed
Blocking some types of cookies may impact your experience of our sites. You may
review and change your choices at any time by clicking Cookie preferences in the
footer of this site. We and selected third-parties use cookies or similar
technologies as specified in the AWS Cookie Notice
.
CancelSave preferences
English
Sign In to the Console
1. AWS
2. ...
3. Documentation
4. Amazon EC2
5. User Guide for Linux Instances
Feedback
Preferences
Amazon Elastic Compute Cloud
User Guide for Linux Instances
* What is Amazon EC2?
* Set up
* Get started tutorial
* Best practices
* Tutorials
* Install LAMP on Amazon Linux 2022
* Install LAMP on Amazon Linux 2
* Install LAMP on the Amazon Linux AMI
* Configure SSL/TLS on Amazon Linux 2022
* Configure SSL/TLS on Amazon Linux 2
* Configure SSL/TLS with the Amazon Linux AMI
* Host a WordPress blog on Amazon Linux 2022
* Host a WordPress blog on Amazon Linux 2
* Amazon Machine Images
* AMI types
* Virtualization types
* Boot modes
* Launch an instance
* AMI boot mode parameter
* Instance type boot mode
* Instance boot mode
* Operating system boot mode
* Set AMI boot mode
* UEFI variables
* UEFI Secure Boot
* How UEFI Secure Boot works
* Launch an instance with UEFI Secure Boot support
* Verify whether an instance is enabled for UEFI Secure Boot
* Create a Linux AMI to support UEFI Secure Boot
* Create three key pairs
* Option A: Add keys to the variable store from within the instance
* Option B: Create a binary blob containing a pre-filled variable
store
* How the AWS binary blob is created
* Find a Linux AMI
* Shared AMIs
* Find shared AMIs
* Make an AMI public
* Share an AMI with organizations or OUs
* Share an AMI with specific AWS accounts
* Use bookmarks
* Guidelines for shared Linux AMIs
* Paid AMIs
* AMI lifecycle
* Create an AMI
* Create an Amazon EBS-backed Linux AMI
* Create an instance store-backed Linux AMI
* Set up the AMI tools
* Create an AMI from an instance store-backed instance
* Convert to an Amazon EBS-Backed AMI
* AMI tools reference
* Copy an AMI
* Store and restore an AMI
* Deprecate an AMI
* Deregister your AMI
* Recover AMIs from the Recycle Bin
* Automate the EBS-backed AMI lifecycle
* Use encryption with EBS-backed AMIs
* Monitor AMI events
* Understand AMI billing
* AMI billing fields
* Find AMI billing information
* Verify AMI charges on your bill
* Amazon Linux
* Run Amazon Linux 2 on premises
* Kernel Live Patching
* User provided kernels
* Configure the MATE desktop connection
* Instances
* Instances and AMIs
* Instance types
* General purpose
* Burstable performance instances
* Key concepts
* Unlimited mode
* Concepts
* Examples
* Standard mode
* Concepts
* Examples
* Work with burstable performance instances
* Monitor your CPU credits
* Compute optimized
* Memory optimized
* Storage optimized
* Accelerated computing
* Install NVIDIA drivers
* Install AMD drivers
* Activate NVIDIA GRID Virtual Applications
* Optimize GPU settings
* Find an instance type
* Get recommendations
* Change the instance type
* Compatibility
* Troubleshoot
* Instance store-backed instances
* Mac instances
* Instance purchasing options
* On-Demand Instances
* Reserved Instances
* Regional and zonal Reserved Instances (scope)
* Types of Reserved Instances (offering classes)
* How Reserved Instances are applied
* Use your Reserved Instances
* How you are billed
* Buy Reserved Instances
* Sell in the Reserved Instance Marketplace
* Modify Reserved Instances
* Exchange Convertible Reserved Instances
* Reserved Instance quotas
* Scheduled Instances
* Spot Instances
* Best practices
* How Spot Instances work
* Spot Instance pricing history
* Savings
* Spot Instance requests
* Example launch specifications
* Spot request status
* Rebalance recommendations
* Spot Instance interruptions
* Reasons for interruption
* Interruption behavior
* Stop
* Hibernate
* Terminate
* Prepare for interruptions
* Spot Instance interruption notices
* Find interrupted Spot Instances
* Determine whether Amazon EC2 interrupted a Spot Instance
* Billing
* Spot placement score
* Spot Instance data feed
* Spot Instance limits
* Burstable performance instances
* Dedicated Hosts
* Work with Dedicated Hosts
* Work with shared Dedicated Hosts
* Host recovery
* Track configuration changes
* Dedicated Instances
* Work with Dedicated Instances
* On-Demand Capacity Reservations
* Capacity Reservation pricing and billing
* Work with Capacity Reservations
* Work with Capacity Reservation groups
* Capacity Reservations in cluster placement groups
* Capacity Reservations in Local Zones
* Capacity Reservations in Wavelength Zones
* Capacity Reservations on AWS Outposts
* Work with shared Capacity Reservations
* Capacity Reservation Fleets
* Capacity Reservation Fleet concepts
* Work with Capacity Reservation Fleets
* Example configurations
* Using Service-Linked Roles
* CloudWatch metrics
* Instance lifecycle
* Launch
* Launch using the launch instance wizard
* Old launch instance wizard
* Launch using a launch template
* Launch an instance from an existing instance
* Use an AWS Marketplace instance
* Connect
* Prerequisites for connecting
* Connect using SSH
* Connect using EC2 Instance Connect
* Set up EC2 Instance Connect
* Connect using EC2 Instance Connect
* Uninstall EC2 Instance Connect
* Connect using PuTTY
* Connect using WSL
* Connect using Session Manager
* Stop and start
* Hibernate
* Overview
* Prerequisites
* Limitations
* Configure an AMI to support hibernation
* Enable hibernation for an instance
* Disable KASLR on an instance (Ubuntu only)
* Hibernate an instance
* Start a hibernated instance
* Troubleshoot
* Reboot
* Retire
* Terminate
* Recover
* Configure instances
* Manage software
* Update software
* Add repositories
* Find software packages
* Install software
* Prepare to compile software
* Manage users
* Processor state control
* I/O scheduler
* Set the time
* Optimize CPU options
* Rules for specifying CPU options
* CPU cores and threads per CPU core per instance type
* Specify CPU options for your instance
* View the CPU options for your instance
* Change the hostname
* Set up dynamic DNS
* Run commands at launch
* Instance metadata and user data
* Use IMDSv2
* Configure the instance metadata options
* Retrieve instance metadata
* Work with instance user data
* Retrieve dynamic data
* Instance metadata categories
* Example: AMI launch index value
* Instance identity documents
* Verify using the PKCS7 signature
* Verify using the base64-encoded signature
* Verify using the RSA-2048 signature
* Elastic Inference
* Identify instances
* Fleets
* EC2 Fleet
* EC2 Fleet request types
* EC2 Fleet 'instant' type
* EC2 Fleet configuration strategies
* Plan an EC2 Fleet
* Allocation strategies for Spot Instances
* Attribute-based instance type selection
* On-Demand backup
* Capacity Rebalancing
* Maximum price overrides
* Control spending
* Instance weighting
* Work with EC2 Fleets
* Spot Fleet
* Spot Fleet request types
* Spot Fleet configuration strategies
* Plan a Spot Fleet request
* Allocation strategy for Spot Instances
* Attribute-based instance type selection
* On-Demand in Spot Fleet
* Capacity Rebalancing
* Spot price overrides
* Control spending
* Instance weighting
* Work with Spot Fleets
* CloudWatch metrics for Spot Fleet
* Automatic scaling for Spot Fleet
* Target tracking scaling policies
* Step scaling policies
* Scheduled scaling
* Monitor fleet events
* EC2 Fleet event types
* Spot Fleet event types
* Create EventBridge rules
* For EC2 Fleet events
* For Spot Fleet events
* Tutorials
* Tutorial: Use EC2 Fleet with instance weighting
* Tutorial: Use EC2 Fleet with On-Demand as the primary capacity
* Tutorial: Launch On-Demand Instances using targeted Capacity
Reservations
* Tutorial: Use Spot Fleet with instance weighting
* Example configurations
* EC2 Fleet example configurations
* Spot Fleet example configurations
* Fleet quotas
* Monitor
* Automated and manual monitoring
* Best practices for monitoring
* Monitor the status of your instances
* Instance status checks
* Scheduled events
* Define event windows for scheduled events
* Monitor your instances using CloudWatch
* Enable detailed monitoring
* List available metrics
* Get statistics for metrics
* Get statistics for a specific instance
* Aggregate statistics across instances
* Aggregate statistics by Auto Scaling group
* Aggregate statistics by AMI
* Graph metrics
* Create an alarm
* Create alarms that stop, terminate, reboot, or recover an instance
* Automate Amazon EC2 with EventBridge
* Monitor memory and disk metrics
* Deprecated: Collect metrics using the CloudWatch monitoring scripts
* Log API calls with AWS CloudTrail
* Networking
* Regions and Zones
* Instance IP addressing
* Multiple IP addresses
* Instance hostname types
* Bring your own IP addresses
* Assigning prefixes
* Work with prefixes
* Elastic IP addresses
* Network interfaces
* Best practices for configuring network interfaces
* Scenarios for network interfaces
* Requester-managed network interfaces
* Network bandwidth
* Enhanced networking
* Enhanced networking: ENA
* Enhanced networking: Intel 82599 VF
* Operating system optimizations
* Network performance metrics
* Troubleshoot ENA
* Elastic Fabric Adapter
* Get started with EFA and MPI
* Get started with EFA and NCCL
* Use a base AMI
* Use an AWS Deep Learning AMI
* Work with EFA
* Monitor an EFA
* Verify the EFA installer using a checksum
* Placement groups
* Network MTU
* Virtual private clouds
* EC2-Classic
* ClassicLink
* Migrate from EC2-Classic to a VPC
* Security
* Infrastructure security
* Resilience
* Data protection
* Identity and access management
* IAM policies
* Policy structure
* Tag resources during creation
* Control access to EC2 resources using resource tags
* Example policies for CLI or SDK
* Example policies for the console
* AWS managed policies
* IAM roles
* Network access
* Key pairs
* Create key pairs
* Tag a public key
* Describe public keys
* Delete a public key
* Add or remove a public key on your instance
* Verify keys
* Security groups
* Security group rules
* Connection tracking
* Default and custom security groups
* Work with security groups
* Security group rules for different use cases
* AWS PrivateLink
* Update management
* Compliance validation
* NitroTPM
* Considerations
* Prerequisites
* Create an AMI for NitroTPM support
* Verify whether an AMI is enabled for NitroTPM
* Enable or stop using NitroTPM on an instance
* Storage
* Amazon EBS
* EBS volumes
* EBS volume types
* Size and configuration constraints
* Create a volume
* Attach a volume to an instance
* Attach a volume to multiple instances
* Make a volume available for use
* View volume details
* Replace a volume
* Monitor the status of your volumes
* Detach a volume from an instance
* Delete a volume
* EBS snapshots
* Create snapshots
* Delete a snapshot
* Copy a snapshot
* Archive snapshots
* Guidelines and best practices for archiving snapshots
* Work with snapshot archiving
* Monitor snapshot archiving
* View snapshot information
* Share a snapshot
* Recover snapshots from the Recycle Bin
* Local snapshots on Outposts
* Amazon EBS direct APIs
* IAM permissions for EBS direct APIs
* Use EBS direct APIs
* Read snapshots
* Write snapshots
* Use encryption
* Use Signature Version 4 signing
* Use checksums
* Idempotency for StartSnapshot API
* Error retries
* Optimize performance
* Interface VPC endpoints
* Log API calls with AWS CloudTrail
* Frequently asked questions
* Automate the snapshot lifecycle
* Amazon Data Lifecycle Manager
* Automate snapshot lifecycles
* Automate AMI lifecycles
* Automate cross-account snapshot copies
* View, modify, and delete lifecycle policies
* AWS Identity and Access Management
* AWS managed policies
* IAM service roles
* Permissions for IAM users
* Permissions for encryption
* Monitor the lifecycle of snapshots and AMIs
* Monitor your policies using CloudWatch Events
* Monitor your policies using Amazon CloudWatch
* EBS data services
* Elastic volumes
* Requirements
* Request volume modifications
* Monitor modifications
* Extend a file system
* EBS encryption
* Fast snapshot restore
* EBS volumes and NVMe
* EBS optimization
* EBS performance
* I/O characteristics and monitoring
* Initialize volumes
* RAID configuration
* Benchmark EBS volumes
* EBS CloudWatch metrics
* EBS CloudWatch events
* EBS quotas
* Instance store
* Add instance store volumes
* SSD instance store volumes
* Instance store swap volumes
* Optimize disk performance
* File storage
* Amazon S3
* Amazon EFS
* Amazon FSx
* Instance volume limits
* Root device volume
* Device names
* Block device mappings
* Resources and tags
* Recycle Bin
* Considerations
* Required IAM permissions
* Work with retention rules
* Work with resources in the Recycle Bin
* Monitoring Recycle Bin using AWS CloudTrail
* Resource locations
* Resource IDs
* List and filter your resources
* Tag your resources
* Service quotas
* Usage reports
* Troubleshoot
* Troubleshoot launch issues
* Connect to your instance
* Stop your instance
* Terminate your instance
* Failed status checks
* Troubleshoot an unreachable instance
* Boot from the wrong volume
* EC2Rescue for Linux
* Install EC2Rescue for Linux
* (Optional) Verify the signature of EC2Rescue for Linux
* Work with EC2Rescue for Linux
* Develop EC2Rescue modules
* EC2 Serial Console
* Configure access to the EC2 Serial Console
* Connect to the EC2 Serial Console
* Terminate an EC2 Serial Console session
* Troubleshoot your instance using the EC2 Serial Console
* Troubleshoot your Linux instance using GRUB
* Troubleshoot your Linux instance using SysRq
* Send a diagnostic interrupt
* Document history
Amazon EBS encryption - Amazon Elastic Compute Cloud
AWSDocumentationAmazon EC2User Guide for Linux Instances
How EBS encryption worksRequirementsDefault KMS key for EBS encryptionEncryption
by defaultEncrypt EBS resourcesEncryption scenariosSet encryption defaults using
the API and CLI
AMAZON EBS ENCRYPTION
PDFRSS
Use Amazon EBS encryption as a straight-forward encryption solution for your EBS
resources associated with your EC2 instances. With Amazon EBS encryption, you
aren't required to build, maintain, and secure your own key management
infrastructure. Amazon EBS encryption uses AWS KMS keys when creating encrypted
volumes and snapshots.
Encryption operations occur on the servers that host EC2 instances, ensuring the
security of both data-at-rest and data-in-transit between an instance and its
attached EBS storage.
You can attach both encrypted and unencrypted volumes to an instance
simultaneously.
Contents
* How EBS encryption works
* Requirements
* Default KMS key for EBS encryption
* Encryption by default
* Encrypt EBS resources
* Encryption scenarios
* Set encryption defaults using the API and CLI
HOW EBS ENCRYPTION WORKS
You can encrypt both the boot and data volumes of an EC2 instance.
When you create an encrypted EBS volume and attach it to a supported instance
type, the following types of data are encrypted:
* Data at rest inside the volume
* All data moving between the volume and the instance
* All snapshots created from the volume
* All volumes created from those snapshots
EBS encrypts your volume with a data key using the industry-standard AES-256
algorithm. Your data key is stored on disk with your encrypted data, but not
before EBS encrypts it with your KMS key. Your data key never appears on disk in
plaintext.The same data key is shared by snapshots of the volume and any
subsequent volumes created from those snapshots if the volumes are encrypted
using the same KMS key as the snapshot. For more information, see Data keys in
the AWS Key Management Service Developer Guide.
Amazon EC2 works with AWS KMS to encrypt and decrypt your EBS volumes in
slightly different ways depending on whether the snapshot from which you create
an encrypted volume is encrypted or unencrypted.
HOW EBS ENCRYPTION WORKS WHEN THE SNAPSHOT IS ENCRYPTED
When you create an encrypted volume from an encrypted snapshot that you own,
Amazon EC2 works with AWS KMS to encrypt and decrypt your EBS volumes as
follows:
1. Amazon EC2 sends a GenerateDataKeyWithoutPlaintext request to AWS KMS,
specifying the KMS key that you chose for volume encryption.
2. If the volume is encrypted using the same KMS key as the snapshot, AWS KMS
uses the same data key as the snapshot and encrypts it under that same KMS
key. If the volume is encrypted using a different KMS key, AWS KMS generates
a new data key and encrypts it under the KMS key that you specified. The
encrypted data key is sent to Amazon EBS to be stored with the volume
metadata.
3. When you attach the encrypted volume to an instance, Amazon EC2 sends a
CreateGrant request to AWS KMS so that it can decrypt the data key.
4. AWS KMS decrypts the encrypted data key and sends the decrypted data key to
Amazon EC2.
5. Amazon EC2 uses the plaintext data key in hypervisor memory to encrypt disk
I/O to the volume. The plaintext data key persists in memory as long as the
volume is attached to the instance.
HOW EBS ENCRYPTION WORKS WHEN THE SNAPSHOT IS UNENCRYPTED
When you create an encrypted volume from unencrypted snapshot, Amazon EC2 works
with AWS KMS to encrypt and decrypt your EBS volumes as follows:
1. Amazon EC2 sends a CreateGrant request to AWS KMS, so that it can encrypt
the volume that is created from the snapshot.
2. Amazon EC2 sends a GenerateDataKeyWithoutPlaintext request to AWS KMS,
specifying the KMS key that you chose for volume encryption.
3. AWS KMS generates a new data key, encrypts it under the KMS key that you
chose for volume encryption, and sends the encrypted data key to Amazon EBS
to be stored with the volume metadata.
4. Amazon EC2 sends a Decrypt request to AWS KMS to get the encryption key to
encrypt the volume data.
5. When you attach the encrypted volume to an instance, Amazon EC2 sends a
CreateGrant request to AWS KMS, so that it can decrypt the data key.
6. When you attach the encrypted volume to an instance, Amazon EC2 sends a
Decrypt request to AWS KMS, specifying the encrypted data key.
7. AWS KMS decrypts the encrypted data key and sends the decrypted data key to
Amazon EC2.
8. Amazon EC2 uses the plaintext data key in hypervisor memory to encrypt disk
I/O to the volume. The plaintext data key persists in memory as long as the
volume is attached to the instance.
For more information, see How Amazon Elastic Block Store (Amazon EBS) uses AWS
KMS and Amazon EC2 example two in the AWS Key Management Service Developer
Guide.
REQUIREMENTS
Before you begin, verify that the following requirements are met.
SUPPORTED VOLUME TYPES
Encryption is supported by all EBS volume types. You can expect the same IOPS
performance on encrypted volumes as on unencrypted volumes, with a minimal
effect on latency. You can access encrypted volumes the same way that you access
unencrypted volumes. Encryption and decryption are handled transparently, and
they require no additional action from you or your applications.
SUPPORTED INSTANCE TYPES
Amazon EBS encryption is available on all current generation instance types and
the following previous generation instance types: A1, C3, cr1.8xlarge, G2, I2,
M3, and R3.
PERMISSIONS FOR IAM USERS
When you configure a KMS key as the default key for EBS encryption, the default
KMS key policy allows any IAM user with access to the required KMS actions to
use this KMS key to encrypt or decrypt EBS resources. You must grant IAM users
permission to call the following actions in order to use EBS encryption:
* kms:CreateGrant
* kms:Decrypt
* kms:DescribeKey
* kms:GenerateDataKeyWithoutPlainText
* kms:ReEncrypt
To follow the principle of least privilege, do not allow full access to
kms:CreateGrant. Instead, allow the user to create grants on the KMS key only
when the grant is created on the user's behalf by an AWS service, as shown in
the following example.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "kms:CreateGrant",
"Resource": [
"arn:aws:kms:us-east-2:123456789012:key/abcd1234-a123-456d-a12b-a123b4cd56ef"
],
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
}
]
}
For more information, see Allows access to the AWS account and enables IAM
policies in the Default key policy section in the AWS Key Management Service
Developer Guide.
DEFAULT KMS KEY FOR EBS ENCRYPTION
Amazon EBS automatically creates a unique AWS managed key in each Region where
you store AWS resources. This KMS key has the alias alias/aws/ebs. By default,
Amazon EBS uses this KMS key for encryption. Alternatively, you can specify a
symmetric customer managed encryption key that you created as the default KMS
key for EBS encryption. Using your own KMS key gives you more flexibility,
including the ability to create, rotate, and disable KMS keys.
Important
Amazon EBS does not support asymmetric encryption KMS keys. For more
information, see Using symmetric and asymmetric encryption KMS keys in the AWS
Key Management Service Developer Guide.
New console
To configure the default KMS key for EBS encryption for a Region
1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. From the navigation bar, select the Region.
3. From the navigation pane, select EC2 Dashboard.
4. In the upper-right corner of the page, choose Account Attributes, EBS
encryption.
5. Choose Manage.
6. For Default encryption key, choose a symmetric customer managed encryption
key.
7. Choose Update EBS encryption.
Old console
To configure the default KMS key for EBS encryption for a Region
1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. From the navigation bar, select the Region.
3. From the navigation pane, select EC2 Dashboard.
4. In the upper-right corner of the page, choose Account Attributes, Settings.
5. Choose Change the default key and then choose an available KMS key.
6. Choose Save settings.
anchoranchor
* New console
* Old console
To configure the default KMS key for EBS encryption for a Region
1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. From the navigation bar, select the Region.
3. From the navigation pane, select EC2 Dashboard.
4. In the upper-right corner of the page, choose Account Attributes, EBS
encryption.
5. Choose Manage.
6. For Default encryption key, choose a symmetric customer managed encryption
key.
7. Choose Update EBS encryption.
ENCRYPTION BY DEFAULT
You can configure your AWS account to enforce the encryption of the new EBS
volumes and snapshot copies that you create. For example, Amazon EBS encrypts
the EBS volumes created when you launch an instance and the snapshots that you
copy from an unencrypted snapshot. For examples of transitioning from
unencrypted to encrypted EBS resources, see Encrypt unencrypted resources.
Encryption by default has no effect on existing EBS volumes or snapshots.
Considerations
* Encryption by default is a Region-specific setting. If you enable it for a
Region, you cannot disable it for individual volumes or snapshots in that
Region.
* When you enable encryption by default, you can launch an instance only if the
instance type supports EBS encryption. For more information, see Supported
instance types.
* If you copy a snapshot and encrypt it to a new KMS key, a complete
(non-incremental) copy is created. This results in additional storage costs.
* When migrating servers using AWS Server Migration Service (SMS), do not turn
on encryption by default. If encryption by default is already on and you are
experiencing delta replication failures, turn off encryption by default.
Instead, enable AMI encryption when you create the replication job.
New console
To enable encryption by default for a Region
1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. From the navigation bar, select the Region.
3. From the navigation pane, select EC2 Dashboard.
4. In the upper-right corner of the page, choose Account Attributes, EBS
encryption.
5. Choose Manage.
6. Select Enable. You keep the AWS managed key with the alias alias/aws/ebs
created on your behalf as the default encryption key, or choose a symmetric
customer managed encryption key.
7. Choose Update EBS encryption.
Old console
To enable encryption by default for a Region
1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. From the navigation bar, select the Region.
3. From the navigation pane, select EC2 Dashboard.
4. In the upper-right corner of the page, choose Account Attributes, Settings.
5. Under EBS Storage, select Always encrypt new EBS volumes.
6. Choose Save settings.
anchoranchor
* New console
* Old console
To enable encryption by default for a Region
1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.
2. From the navigation bar, select the Region.
3. From the navigation pane, select EC2 Dashboard.
4. In the upper-right corner of the page, choose Account Attributes, EBS
encryption.
5. Choose Manage.
6. Select Enable. You keep the AWS managed key with the alias alias/aws/ebs
created on your behalf as the default encryption key, or choose a symmetric
customer managed encryption key.
7. Choose Update EBS encryption.
You cannot change the KMS key that is associated with an existing snapshot or
encrypted volume. However, you can associate a different KMS key during a
snapshot copy operation so that the resulting copied snapshot is encrypted by
the new KMS key.
ENCRYPT EBS RESOURCES
You encrypt EBS volumes by enabling encryption, either using encryption by
default or by enabling encryption when you create a volume that you want to
encrypt.
When you encrypt a volume, you can specify the symmetric encryption KMS key to
use to encrypt the volume. If you do not specify a KMS key, the KMS key that is
used for encryption depends on the encryption state of the source snapshot and
its ownership. For more information, see the encryption outcomes table.
Note
If you are using the API or AWS CLI to specify a KMS key, be aware that AWS
authenticates the KMS key asynchronously. If you specify a KMS key ID, an alias,
or an ARN that is not valid, the action can appear to complete, but it
eventually fails.
You cannot change the KMS key that is associated with an existing snapshot or
volume. However, you can associate a different KMS key during a snapshot copy
operation so that the resulting copied snapshot is encrypted by the new KMS key.
ENCRYPT AN EMPTY VOLUME ON CREATION
When you create a new, empty EBS volume, you can encrypt it by enabling
encryption for the specific volume creation operation. If you enabled EBS
encryption by default, the volume is automatically encrypted using your default
KMS key for EBS encryption. Alternatively, you can specify a different symmetric
encryption KMS key for the specific volume creation operation. The volume is
encrypted by the time it is first available, so your data is always secured. For
detailed procedures, see Create an Amazon EBS volume.
By default, the KMS key that you selected when creating a volume encrypts the
snapshots that you make from the volume and the volumes that you restore from
those encrypted snapshots. You cannot remove encryption from an encrypted volume
or snapshot, which means that a volume restored from an encrypted snapshot, or a
copy of an encrypted snapshot, is always encrypted.
Public snapshots of encrypted volumes are not supported, but you can share an
encrypted snapshot with specific accounts. For detailed directions, see Share an
Amazon EBS snapshot.
ENCRYPT UNENCRYPTED RESOURCES
You cannot directly encrypt existing unencrypted volumes or snapshots. However,
you can create encrypted volumes or snapshots from unencrypted volumes or
snapshots. If you enable encryption by default, Amazon EBS automatically
encrypts new volumes and snapshots using your default KMS key for EBS
encryption. Otherwise, you can enable encryption when you create an individual
volume or snapshot, using either the default KMS key for Amazon EBS encryption
or a symmetric customer managed encryption key. For more information, see Create
an Amazon EBS volume and Copy an Amazon EBS snapshot.
To encrypt the snapshot copy to a customer managed key, you must both enable
encryption and specify the KMS key, as shown in Copy an unencrypted snapshot
(encryption by default not enabled).
Important
Amazon EBS does not support asymmetric encryption KMS keys. For more
information, see Using Symmetric and Asymmetric encryption KMS keys in the AWS
Key Management Service Developer Guide.
You can also apply new encryption states when launching an instance from an
EBS-backed AMI. This is because EBS-backed AMIs include snapshots of EBS volumes
that can be encrypted as described. For more information, see Use encryption
with EBS-backed AMIs.
ENCRYPTION SCENARIOS
When you create an encrypted EBS resource, it is encrypted by your account's
default KMS key for EBS encryption unless you specify a different customer
managed key in the volume creation parameters or the block device mapping for
the AMI or instance. For more information, see Default KMS key for EBS
encryption.
The following examples illustrate how you can manage the encryption state of
your volumes and snapshots. For a full list of encryption cases, see the
encryption outcomes table.
Examples
* Restore an unencrypted volume (encryption by default not enabled)
* Restore an unencrypted volume (encryption by default enabled)
* Copy an unencrypted snapshot (encryption by default not enabled)
* Copy an unencrypted snapshot (encryption by default enabled)
* Re-encrypt an encrypted volume
* Re-encrypt an encrypted snapshot
* Migrate data between encrypted and unencrypted volumes
* Encryption outcomes
RESTORE AN UNENCRYPTED VOLUME (ENCRYPTION BY DEFAULT NOT ENABLED)
Without encryption by default enabled, a volume restored from an unencrypted
snapshot is unencrypted by default. However, you can encrypt the resulting
volume by setting the Encrypted parameter and, optionally, the KmsKeyId
parameter. The following diagram illustrates the process.
If you leave out the KmsKeyId parameter, the resulting volume is encrypted using
your default KMS key for EBS encryption. You must specify a KMS key ID to
encrypt the volume to a different KMS key.
For more information, see Create a volume from a snapshot.
RESTORE AN UNENCRYPTED VOLUME (ENCRYPTION BY DEFAULT ENABLED)
When you have enabled encryption by default, encryption is mandatory for volumes
restored from unencrypted snapshots, and no encryption parameters are required
for your default KMS key to be used. The following diagram shows this simple
default case:
If you want to encrypt the restored volume to a symmetric customer managed
encryption key, you must supply both the Encrypted and KmsKeyId parameters as
shown in Restore an unencrypted volume (encryption by default not enabled).
COPY AN UNENCRYPTED SNAPSHOT (ENCRYPTION BY DEFAULT NOT ENABLED)
Without encryption by default enabled, a copy of an unencrypted snapshot is
unencrypted by default. However, you can encrypt the resulting snapshot by
setting the Encrypted parameter and, optionally, the KmsKeyId parameter. If you
omit KmsKeyId, the resulting snapshot is encrypted by your default KMS key. You
must specify a KMS key ID to encrypt the volume to a different symmetric
encryption KMS key.
The following diagram illustrates the process.
You can encrypt an EBS volume by copying an unencrypted snapshot to an encrypted
snapshot and then creating a volume from the encrypted snapshot. For more
information, see Copy an Amazon EBS snapshot.
COPY AN UNENCRYPTED SNAPSHOT (ENCRYPTION BY DEFAULT ENABLED)
When you have enabled encryption by default, encryption is mandatory for copies
of unencrypted snapshots, and no encryption parameters are required if your
default KMS key is used. The following diagram illustrates this default case:
RE-ENCRYPT AN ENCRYPTED VOLUME
When the CreateVolume action operates on an encrypted snapshot, you have the
option of re-encrypting it with a different KMS key. The following diagram
illustrates the process. In this example, you own two KMS keys, KMS key A and
KMS key B. The source snapshot is encrypted by KMS key A. During volume
creation, with the KMS key ID of KMS key B specified as a parameter, the source
data is automatically decrypted, then re-encrypted by KMS key B.
For more information, see Create a volume from a snapshot.
RE-ENCRYPT AN ENCRYPTED SNAPSHOT
The ability to encrypt a snapshot during copying allows you to apply a new
symmetric encryption KMS key to an already-encrypted snapshot that you own.
Volumes restored from the resulting copy are only accessible using the new KMS
key. The following diagram illustrates the process. In this example, you own two
KMS keys, KMS key A and KMS key B. The source snapshot is encrypted by KMS key
A. During copy, with the KMS key ID of KMS key B specified as a parameter, the
source data is automatically re-encrypted by KMS key B.
In a related scenario, you can choose to apply new encryption parameters to a
copy of a snapshot that has been shared with you. By default, the copy is
encrypted with a KMS key shared by the snapshot's owner. However, we recommend
that you create a copy of the shared snapshot using a different KMS key that you
control. This protects your access to the volume if the original KMS key is
compromised, or if the owner revokes the KMS key for any reason. For more
information, see Encryption and snapshot copying.
MIGRATE DATA BETWEEN ENCRYPTED AND UNENCRYPTED VOLUMES
When you have access to both an encrypted and unencrypted volume, you can freely
transfer data between them. EC2 carries out the encryption and decryption
operations transparently.
For example, use the rsync command to copy the data. In the following command,
the source data is located in /mnt/source and the destination volume is mounted
at /mnt/destination.
[ec2-user ~]$ sudo rsync -avh --progress /mnt/source/ /mnt/destination/
ENCRYPTION OUTCOMES
The following table describes the encryption outcome for each possible
combination of settings.
Is encryption enabled? Is encryption by default enabled? Source of volume
Default (no customer managed key specified) Custom (customer managed key
specified) No No New (empty) volume Unencrypted N/A No No Unencrypted snapshot
that you own Unencrypted No No Encrypted snapshot that you own Encrypted by same
key No No Unencrypted snapshot that is shared with you Unencrypted No No
Encrypted snapshot that is shared with you Encrypted by default customer managed
key* Yes No New volume Encrypted by default customer managed key Encrypted by a
specified customer managed key** Yes No Unencrypted snapshot that you own
Encrypted by default customer managed key Yes No Encrypted snapshot that you own
Encrypted by same key Yes No Unencrypted snapshot that is shared with you
Encrypted by default customer managed key Yes No Encrypted snapshot that is
shared with you Encrypted by default customer managed key No Yes New (empty)
volume Encrypted by default customer managed key N/A No Yes Unencrypted snapshot
that you own Encrypted by default customer managed key No Yes Encrypted snapshot
that you own Encrypted by same key No Yes Unencrypted snapshot that is shared
with you Encrypted by default customer managed key No Yes Encrypted snapshot
that is shared with you Encrypted by default customer managed key Yes Yes New
volume Encrypted by default customer managed key Encrypted by a specified
customer managed key Yes Yes Unencrypted snapshot that you own Encrypted by
default customer managed key Yes Yes Encrypted snapshot that you own Encrypted
by same key Yes Yes Unencrypted snapshot that is shared with you Encrypted by
default customer managed key Yes Yes Encrypted snapshot that is shared with you
Encrypted by default customer managed key
* This is the default customer managed key used for EBS encryption for the AWS
account and Region. By default this is a unique AWS managed key for EBS, or you
can specify a customer managed key. For more information, see Default KMS key
for EBS encryption.
** This is a customer managed key specified for the volume at launch time. This
customer managed key is used instead of the default customer managed key for the
AWS account and Region.
SET ENCRYPTION DEFAULTS USING THE API AND CLI
You can manage encryption by default and the default KMS key using the following
API actions and CLI commands.
API action CLI command Description
DisableEbsEncryptionByDefault
disable-ebs-encryption-by-default
Disables encryption by default.
EnableEbsEncryptionByDefault
enable-ebs-encryption-by-default
Enables encryption by default.
GetEbsDefaultKmsKeyId
get-ebs-default-kms-key-id
Describes the default KMS key.
GetEbsEncryptionByDefault
get-ebs-encryption-by-default
Indicates whether encryption by default is enabled.
ModifyEbsDefaultKmsKeyId
modify-ebs-default-kms-key-id
Changes the default KMS key used to encrypt EBS volumes.
ResetEbsDefaultKmsKeyId
reset-ebs-default-kms-key-id
Resets the AWS managed key as the default KMS key used to encrypt EBS volumes.
Javascript is disabled or is unavailable in your browser.
To use the Amazon Web Services Documentation, Javascript must be enabled. Please
refer to your browser's Help pages for instructions.
Document Conventions
Extend a file system
Fast snapshot restore
Did this page help you? - Yes
Thanks for letting us know we're doing a good job!
If you've got a moment, please tell us what we did right so we can do more of
it.
Did this page help you? - No
Thanks for letting us know this page needs work. We're sorry we let you down.
If you've got a moment, please tell us how we can make the documentation better.
Did this page help you?
YesNo
Provide feedback
Edit this page on GitHub
Next topic:Fast snapshot restore
Previous topic:Extend a file system
Need help?
* Try AWS re:Post
* Connect with an AWS IQ expert
PrivacySite termsCookie preferences
© 2022, Amazon Web Services, Inc. or its affiliates. All rights reserved.
On this page
--------------------------------------------------------------------------------
* How EBS encryption works
* Requirements
* Default KMS key for EBS encryption
* Encryption by default
* Encrypt EBS resources
* Encryption scenarios
* Set encryption defaults using the API and CLI
DID THIS PAGE HELP YOU? - NO
Thanks for letting us know this page needs work. We're sorry we let you down.
If you've got a moment, please tell us how we can make the documentation better.
Feedback