How do you find the EBS Volume IDS for a Volume that was created and attached at EC2 Instance Launch Time ?

Question

When Creating and Attaching an EBS Volume at RunInstances time, the CreateVolume and AttachVolume CloudTrail entries are missing.  I don't see any CloudTrail entries that are related to the created volume until we do a snapshot, then detach, then delete.  Once the instance is running, if we create a second EBS Volume, and attach it, snapshot it, detach it, and then delete the volume, we what you would expect, which is CreateVolume -> AttachVolume -> CreateSnapshot -> DetachVolume -> DeleteVolume in the CloudTrail Logs.

When we look at the RunInstances event for the instance creation, there is no reference to the EBS Volume Id that was create during instance run time.   My question is, is there any way to find all EBS volumes that are attached to a running EC2 instance when those EBS Volumes were created and attached at instance run time by using CloudTrail logs ?

We can see the volume information in the RunInstances JSON for the instance launch :

{
                    "deviceName": "/dev/sdb",
                    "ebs": {
                        "volumeSize": 5,
                        "deleteOnTermination": true,
                        "volumeType": "gp3",
                        "iops": 3000,
                        "throughput": 125
                    }
                }
But again, there is no reference to the actual volume-id .

Thanks for any pointers !

Answer

Using the AWS CLI, you can use the Describe-Volume operation by passing the attached EC2 Instance ID as a filter to find ALL volumes attached to it.

Check out example 2 on in the CLI reference which is similar to what you are asking: https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html

How do you find the EBS Volume IDS for a Volume that was created and attached at EC2 Instance Launch Time ?

Contenido relevante