# All about Amazon EBS Volume Encryption ### EBS Volume Encryption Key Points - Encryption is supported by all EBS volume types. - Amazon EBS offers volume encryption capability. - The [volume key is encrypted](https://docs.aws.amazon.com/kms/latest/cryptographic-details/ebs-volume-encryption.html) under a KMS key in your account. - Amazon EBS must have access to generate a volume key (VK) under a KMS key in the account. [We must grant access permission for Amazon EBS to use the KMS key](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#ebs-encryption-requirements) to create data keys and to encrypt and decrypt EBS Volumes. - Amazon EBS can use AWS KMS with a "KMS key" to generate KMS encrypted volume keys. Cxs aren't required to build, maintain, and secure their own key management infrastructure. - Amazon EBS does **not** support asymmetric encryption KMS keys. Main Difference between Asymmetric and Symmetric Encryption Types [here](https://www.ssl2buy.com/wiki/symmetric-vs-asymmetric-encryption-what-are-differences#:~:text=Difference%20Between%20Symmetric%20and%20Asymmetric,and%20decrypt%20messages%20when%20communicating.) - EBS encrypts your volume with a data key using the industry-standard AES-256 XTS algorithm. Your data key is stored on disk with your encrypted data, but not before EBS encrypts it with your KMS key. Your data key never appears on disk in plaintext.The same data key is shared by snapshots of the volume and any subsequent volumes created from those snapshots if the volumes are encrypted using the same KMS key as the snapshot. - We can manage(enable/disable) encryption by default and the default KMS key using [API actions and CLI commands](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default-api). ### When will EBS Volume be encrypted and unencrypted during EBS Operations When we create an encrypted EBS volume and attach it to a supported instance type, the following types of data are encrypted: - Data at rest inside the volume - All data moving between the volume and the instance - All snapshots created from the encrypted volume - All volumes/ami created from those snapshots An AWSome picture representation of encrypted and unencrypted volumes during EBS Operations. **Thanks to Matt Phillipy. ** ![screely-1662603985724.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662603996941/ixqlrM-A9.png align="left") ### How-To Convert Unencrypted Volumes to Encrypted EBS Volumes Step 1: On your EC2 instance with Volumes are UnEncrypted ![screely-1662606838438.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662606873162/a14FAw8Vy.png align="left") Step 2: Create a Snapshot from unencrypted volume. ![screely-1662607099712.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662607105637/XdszJAVJ6.png align="left") NOTE : It is not recommended to create Snapshot of Volume while data is being read/written on EBS storage. Reason being, While snapshot is getting created or during the creation, It would not have new data of Running EBS volume and drift will occur of data in the snapshot and new data. So better to Stop your EC2 instance before Converting Volume Encryption / snapshot operation. Step 3: Volume Snapshots will be unencrypted since it was created from unencrypted Volumes. ![screely-1662607345432.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662607394022/96cNlmQ2A.png align="left") Step 4: Two Options. 1st Option: Create Encrypted Volume from a Snapshot. Note : No Option to change Region. ![screely-1662608737686.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662608774367/QSw5pdvUA.png align="left") ![screely-1662608748729.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662608783210/cKG6QDBGV.png align="left") Copy unencrypted Volume snapshot to an encrypted Volume snapshot. Note : Can change the Region of Copied Snapshot. ![screely-1662609109106.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662609128191/Yc0e95-Vu.png align="left") ![screely-1662609120389.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662609138716/yu4-WVP-A.png align="left") ![screely-1662609523707.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662609526070/edP8Xt-TX.png align="left") ![screely-1662609892933.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662609902543/Q6nkqp-hF.png align="left") See all the Volumes attached and not attached to instances with encryption status. Go to Step 5 ![screely-1662610062466.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662610070347/DxGFn1DaL.png align="left") Step 5: Detach the original EBS volume and attach your new encrypted EBS volume, making sure to match the device name (/dev/xvda1, etc.) ![screely-1662610365954.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662610733249/ywfjXm2G_.png align="left") ![screely-1662610374863.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662610741756/JCRMFC2UU.png align="left") ![screely-1662611165341.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662611175259/_WEL-C1Z9.png align="left") **Successfully** running "TestVM" with attached Encrypted Volumes. ![screely-1662611459922.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662611482047/fyzWlDC3u.png align="left") ### [How-to TURN-ON automatic encryption of new Amazon EBS volumes and snapshot copies?](https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/) ![screely-1662603116477.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662603126235/W_jnF1qce.png align="left") ![screely-1662603170223.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1662603180488/hXIjTiZ-u.png align="left") 1. Open the Amazon EC2 console. 2. Select the Region from the drop-down menu. 3. On the EC2 Dashboard, under Account Attributes, select Settings. 4. Under EBS Storage, select Always encrypt new EBS volumes. 5. Select Change the default key and choose any of your keys (default/CMKs) as the Default encryption key. Select Save Settings by Update EBS Encryption. ### Encryption scenarios - [Restore an unencrypted volume (encryption by default not enabled)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#volume-account-off) - [Restore an unencrypted volume (encryption by default enabled)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#volume-account-on) - [Copy an unencrypted snapshot (encryption by default not enabled)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#snapshot-account-off) - [Copy an unencrypted snapshot (encryption by default enabled)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#snapshot-account-on) - [Re-encrypt an encrypted volume](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#reencrypt-volume) - [Re-encrypt an encrypted snapshot](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#reencrypt-snapshot) - [Migrate data between encrypted and unencrypted volumes Encryption outcomes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#migrate-data-encrypted-unencrypted) - [Encryption outcomes](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#ebs-volume-encryption-outcomes) More on that [here](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#ebs-volume-encryption-outcomes) ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1661064007323/eUdQv64uk.png align="left") ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1661063974387/JHDBdxJwR.png align="left") Thank you for reading and/or following along with the Blog. Happy Learning. Like and Follow for more Azure and AWS Content. Regards, [Jineshkumar Patel](https://jineshkumar.bio.link/)