How to encrypt EBS using Terraform after launching an EC2

3
votes

If I launch an EC2, the root EBS will not be encrypted (not sure why, maybe because the EC2 is launched from an public AMI. but even I create my own encrypted AMI, I cannot launch an EC2 from it....)

Anyway, I know that I can encrypt an EBS from an exist EC2 in this way: launch an EC2 first, then snapshot it, then copy the snapshot to a new snapshot and set the new snapshot as encrypted, then create a volume from the new snapshot, then detach the EC2 from the existing un-encrypted volume, then attach the EC2 to the new encrypted volume and set device as /dev/sda1. Finally, the EC2’s EBS will become encrypted. As you see, the steps are complex.

In fact, I need to create an EC2, and the EC2 should have root EBS encrypted, using Terraform. The above steps seem complex and I do not know how to develop them using Terraform.

My question is: How to write Terraform code encrypt EBS, after launching an EC2? Any solution is OK, I just want to develop it using Terraform. if Terraform cannot to do that, what other automation tool I should use?

1
amazon-web-servicesencryptionamazon-ec2terraformaws-ebs
"but even I create my own encrypted AMI, I cannot launch an EC2 from it" Stop, there. You should be able to do this, and it's the simple/obvious solution. Why do you say you can't launch an instance from an AMI built with encrypted snapshots? – Michael - sqlbot
@Michael - sqlbot: last time after I created my own encrypted AMI from public ubuntu16.4(ami-79aeae19). I launched an EC2 from my own encrypted AMI, it failed. the error message showed: launch failed the encrypted flag cannot be specified since device /dev/sda1 has a snapshot specified. today I tried again, it works! So my solution will be: manually create a encrypted AMI in advance, then use it to launch my EC2 in terraform. Thanks! – user389955

1 Answers

0
votes

I had the same issue. If you add this into your terraform script. And then destroy your build and reapply it, all your Ec2 instances will by default be built with an attached EBS volume which is encrypted.

 resource "aws_ebs_encryption_by_default" "enabled" {
 enabled = true
  }