CloudFormation changes

Hello, I have created an EC2 instance with Boot and Data EBS volume having AWS managed KMS key encryption using Cloud Formation Template Deployment.
Now, I have to change the EBS volume encryption to CMK KMS key. Will my EC2 instance get destroy and recreate again on next cloud formation deployment after making encryption key changes manually to EBS. How can I avoid destroying my EC2 instance.

주제

관리 및 거버넌스

태그

AWS CloudFormation 암호화

언어

English

Himanshu

질문됨 2년 전221회 조회

1개 답변

최신
최다 투표
가장 많은 댓글

이 답변이 도움이 되었나요?커뮤니티가 여러분의 지식을 활용할 수 있도록 정답을 찬성하세요.

Hi There

After the instance is running, modifying the KmsKeyId parameter of the EBS volume inside the BlockDeviceMapping property results in instance replacement.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-blockdev-template.html

You cannot change the encryption key on an EBS volume. You need to take a snapshot and create new volumes with the new key See https://aws.amazon.com/premiumsupport/knowledge-center/ebs-change-encryption-key/

Can you clarify though, have you already changed the EBS encryption outside of CloudFormation?

전문가

Matt-B

답변함 2년 전

Himanshu
2년 전
Hello, I've not updated teh KMS key yet, but will be following steps mentioned in this article and attach the new volumes to EC2 server, https://aws.amazon.com/premiumsupport/knowledge-center/ebs-change-encryption-key/

How can I avoid instance replacement.

CloudFormation changes

관련 콘텐츠