How do I use the "Replace root volume" feature to encrypt an EBS root volume?

Resolution

To avoid manual re-encryption, use the Replace root volume feature in Amazon Elastic Compute Cloud (Amazon EC2) to encrypt your unencrypted EBS root volume. This feature transitions your volume to an encrypted state and offers enhanced data security for your EC2 instance.

Activate EBS encryption as a default

To set the default, complete the following steps:

1. Navigate to the Amazon EC2 console.
2. Select your Region.
3. In your left navigation pane, choose EC2 Dashboard.
4. For Account Attributes, choose Data protection and security.
5. For EBS encryption, choose Manage. Then, activate Always encrypt new EBS volumes.
6. Select a default encryption key.
7. To confirm your changes, choose Update EBS encryption.

Create a snapshot

Complete the following steps:

1. Open the Amazon EC2 console.
2. From the left navigation pane, choose Snapshots. Then, choose Create snapshot.
3. Choose Volume as the resource type.
4. Select the root volume of your EC2 instance.
5. To implement the changes, choose Create snapshot.

Replace the unencrypted root volume with an encrypted volume

Complete the following steps:

1. Navigate to the Amazon EC2 console.
2. From the left navigation pane, choose Instances.
3. Select the instance that you want to replace the root volume for.
4. Choose Actions. Then, choose Monitor and troubleshoot.
5. Choose Replace root volume.
   Note: Make sure that the instance is running for the action to activate.
6. Select the snapshot that you created for your root volume.
7. To initiate replacement, choose Create replacement task.
   Note: The instance automatically reboots during this process, erasing the memory (RAM) contents without requiring a manual reboot.

Monitor the progress of the root volume replacement task

Follow these steps to complete the replacement task:

1. Navigate to the Instances section.
2. Select the instance and access the Storage tab.
3. To track completion, expand Recent root volume replacement tasks.

When the root volume replacement task completes, your root volume is securely encrypted. The replacement also provides enhanced data protection for your EC2 instance.