Wednesday, 27 July 2016

Migrate EBS encrypted volumes from default KMS CMK to custom CMK

If you would like to take advantage of copying our encrypted EBS volume snapshots from one account to another as documented:
https://aws.amazon.com/blogs/aws/new-cross-account-copying-of-encrypted-ebs-snapshots/ If you have encrypted EBS volumes with default KMS CMK, then you need to migrate encrypted EBS volumes from default CMK to custom CMK...Here is how:
# create snapshot of volumes
VOLUMES=$(aws ec2 describe-volumes --query 'Volumes[].VolumeId' --output text) for V in $VOLUMES do echo $V aws ec2 create-snapshot --volume-id $V --dry-run done # copy snapshot from default to custom CMK
SNAPSHOTS=$(aws ec2 describe-snapshots --owner-id 12345679810 --query 'Snapshots[].SnapshotId' --output text) for S in $SNAPSHOTS do echo $V aws ec2 copy-snapshot --source-snapshot-id $S --source-region eu-west-1 --encrypted --kms-key-id 2bfc8cc1-1389-4bfc-af8d-topsecret --description 'Re-encrypted snapshots with a CMK to enable cross-account sharing' done
# create EBS volume with custom CMK NEWVOLUMES=$(aws ec2 describe-snapshots --owner-id <redacted> --filters Name=description,Values="Re-encrypted snapshots with a CMK to enable cross-account sharing" --query 'Snapshots[].SnapshotId' --output text) for N in $NEWVOLUMES do echo $N aws ec2 create-volume --snapshot-id $N --availability-zone eu-west-1a --volume-type gp2 done

No comments:

Post a Comment