EBS Encryption · 04 - EC2 Instance Storage

What You Get with Encrypted EBS

When you create an encrypted EBS volume, all of the following are encrypted:

What	Encrypted?
Data at rest inside the volume	✅
Data in flight (instance ↔ volume)	✅
All snapshots from the volume	✅
All volumes created from those snapshots	✅

Transparent Encryption

Encryption/decryption is handled transparently by EC2 and EBS. You have nothing to do — minimal impact on latency.

What EBS encryption covers

Rest, flight, snapshots and volumes made from those snapshots are all encrypted.

Key Facts

Feature	Details
Algorithm	AES-256
Key management	AWS KMS (Key Management Service)
Performance impact	Minimal (almost none)
Recommendation	Always use encryption

How to Encrypt an Unencrypted EBS Volume

Step 1: Create snapshot of unencrypted volume
            │
            ▼
Step 2: Copy snapshot with encryption enabled
            │
            ▼
Step 3: Create new volume from encrypted snapshot
            │
            ▼
Step 4: Attach encrypted volume to instance

Shortcut

You can also create an encrypted volume directly from an unencrypted snapshot by enabling encryption during the "Create Volume from Snapshot" step.

Console Steps

Method 1 (Full):
  Snapshot → Actions → Copy Snapshot → Enable Encryption → Select KMS Key
  → Create Volume from encrypted snapshot

Method 2 (Shortcut):
  Unencrypted Snapshot → Actions → Create Volume from Snapshot
  → Enable Encryption → Select KMS Key → Create Volume

Encrypt an unencrypted volume: two console paths

Snapshot -> Actions -> Copy Snapshot
  -> Enable Encryption -> Select KMS Key
Then: Create Volume from the encrypted snapshot

Copy the snapshot with encryption on, then build the volume from the encrypted copy.

Unencrypted Snapshot -> Actions -> Create Volume from Snapshot
  -> Enable Encryption -> Select KMS Key -> Create Volume

One step fewer: enable encryption while creating the volume from the unencrypted snapshot.

Encrypting an unencrypted volume

There is no toggle. Go through a snapshot and a new volume.

Questions & Answers

Q1: What does EBS encryption protect?

Answer:

Everything:

Data at rest inside the volume
Data in flight between instance and volume
All snapshots created from the volume
All volumes created from those snapshots

Q2: What encryption algorithm does EBS use?

Answer:

AES-256, managed through AWS KMS (Key Management Service). You can use the default aws/ebs key or a custom KMS key.

Q3: Does EBS encryption impact performance?

Answer:

Minimal impact. The encryption/decryption is handled transparently by EC2 and EBS behind the scenes. AWS recommends always using encryption.

Q4: How do you encrypt an existing unencrypted EBS volume?

Answer:

Create a snapshot of the unencrypted volume
Copy the snapshot with encryption enabled (or create volume directly with encryption)
Create a new encrypted volume from the encrypted snapshot
Attach the encrypted volume to the instance

Q5: Can you directly encrypt an existing unencrypted EBS volume?

Answer:

No. You cannot toggle encryption on an existing volume. You must go through the snapshot → copy/create with encryption → new volume process.

Q6: If a snapshot is encrypted, will volumes created from it be encrypted?

Answer:

Yes. Volumes created from encrypted snapshots are automatically encrypted. The encryption chain is maintained.

Q7: If a snapshot is unencrypted, can you create an encrypted volume from it?

Answer:

Yes. When creating a volume from an unencrypted snapshot, you can enable encryption on the fly and select a KMS key. This is the shortcut method.

Q8: What is the default KMS key for EBS encryption?

Answer:

aws/ebs — the AWS-managed default key. You can also use your own customer-managed KMS keys for more control over key rotation and access policies.

Q9: Can you enable EBS encryption by default for a region?

Answer:

Yes. In the EC2 console under EBS settings, you can enable encryption by default. All new EBS volumes and snapshots in that region will be automatically encrypted.

Q10: Is an unencrypted snapshot from an unencrypted volume also unencrypted?

Answer:

Yes. Snapshots inherit the encryption state of their source volume. An unencrypted volume produces unencrypted snapshots. To get an encrypted snapshot, you must copy it with encryption enabled.

Check yourself

Quiz

Flashcards

Click the card (or focus it), then use ← → to move and Space to flip.