CODEWITHSUNDEEP
amazon-web-servicesamazon-ebs
james camm
james camm

Reputation: 35

Do I need to Encrypt EBS Snapshot when copying AMI to another availability zone?

Hi I am an AWS newbie and I am moving an AMI instance from one availability zone to another, and I was wondering if I need to select the encrypt EBS Snapshot option when copying an AMI from say Oregon to Virginia.

If I don't encrypt the snapshot, does that mean any hacker can see what is in my AMI enroute from one availability zone to another?

Thanks

Upvotes: 1

Views: 205

Answers (2)

Kobi Lehrer
Kobi Lehrer

Reputation: 301

When copying data over a public network (including to a cloud) you should always use encryption. Amazon provides encryption for data at rest, data movements within AWS offerings and for any snapshots you create. When moving data they do recommend using a custom CMK, not your standard one, and then allowing individual users access to that key. Their documentation has more details: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html.

And since you can't directly change the encryption status of a volume, encrypting your snapshot is the way to go. Depending on your needs, you may decide to encrypt new volumes, or all snapshots -- regardless of availability zone.

If you'd like more information on managing EBS volumes, NetApp has a good article here.

Upvotes: 0

Mark B
Mark B

Reputation: 200562

The option to encrypt an EBS Snapshot provides encryption-at-rest. This is to prevent someone with access to the underlying hardware, like an Amazon employee, from being able to read the information on the disk.

Your concern that someone could see the data as it is transmitted between regions is covered by encyption-in-motion. AWS will automatically use SSL encryption to ensure that the data being transmitted will not be readable by anyone.

Upvotes: 3

Related Questions