EBS Snapshot Question

Question

We have some EBS snapshots that were unencrypted that came up on a finding. I made a copy of the EBS snapshots and encrypted them. I notice previous unencrypted EBS snapshots were associated with AMIs before deleting them to resolve the finding. I am worried if I complete these actions in the url below it will mess up the AMIs. Please advise the best way to do this without messing anything up or if that is not possible? Thanks in advance

https://aws.amazon.com/premiumsupport/knowledge-center/snapshot-in-use-error/#:~:text=If%20you%20no%20longer%20need,the%20navigation%20pane%2C%20choose%20AMIs.

Answer

Hello Bryan,

EBS snapshots associated with the AMIs are tightly coupled. From your question, I assume that you have manually copied the unencrypted EBS snapshots and created encrypted copies but they would have not associated back with the AMI. If you follow the url that you mentioned and deregister the AMI in order to delete the old unencrypted snapshots , then the AMI will be lost and you cannot use it  again.

The best way to do this is make copy of your AMI itself. During the ami copy , you will get option to enable the encryption so the new snapshots that gets created will be encrypted and associated with the new AMI (copy of old). Then you can follow the url that you have mentioned to deregister the old ami and delete the old unencrypted snapshots.

Follow the steps in this page https://docs.amazonaws.cn/en_us/AWSEC2/latest/UserGuide/CopyingAMIs.html#ami-copy-steps , Refer to section "**Copy an AMI**" and you can make copy of your existing AMI along with enabling encryption.

By this way, you will have your new AMI with encrypted snapshots. and delete the old AMI & its associated unencrypted snapshots.

EBS Snapshot Question

Relevant content