If you would like to take advantage of copying our encrypted EBS volume snapshots from one account to another as documented:
https://aws.amazon.com/blogs/aws/new-cross-account-copying-of-encrypted-ebs-snapshots/
If you have encrypted EBS volumes with default KMS CMK, then you need to migrate encrypted EBS volumes from default CMK to custom CMK...Here is how:
# create snapshot of volumes
VOLUMES=$(aws ec2 describe-volumes --query 'Volumes[].VolumeId' --output text)
for V in $VOLUMES
do
echo $V
aws ec2 create-snapshot --volume-id $V --dry-run
done
# copy snapshot from default to custom CMK
SNAPSHOTS=$(aws ec2 describe-snapshots --owner-id 12345679810 --query 'Snapshots[].SnapshotId' --output text)
for S in $SNAPSHOTS
do
echo $V
aws ec2 copy-snapshot --source-snapshot-id $S --source-region eu-west-1 --encrypted --kms-key-id 2bfc8cc1-1389-4bfc-af8d-topsecret --description 'Re-encrypted snapshots with a CMK to enable cross-account sharing'
done
# create EBS volume with custom CMK
NEWVOLUMES=$(aws ec2 describe-snapshots --owner-id <redacted> --filters Name=description,Values="Re-encrypted snapshots with a CMK to enable cross-account sharing" --query 'Snapshots[].SnapshotId' --output text)
for N in $NEWVOLUMES
do
echo $N
aws ec2 create-volume --snapshot-id $N --availability-zone eu-west-1a --volume-type gp2
done
No comments:
Post a Comment