Lesson 06 — Amazon EBS Encryption & AMIs

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Amazon Elastic Block Store (EBS).
Explain how EBS encryption works.
Understand AWS Key Management Service (AWS KMS).
Create encrypted EBS volumes.
Understand Amazon Machine Images (AMIs).
Create custom AMIs.
Deploy EC2 instances from custom AMIs.
Apply enterprise security best practices.

📚 Lesson Information

Estimated Time: 2.5 Hours

Difficulty: Intermediate

Prerequisites: Lesson 05 – IAM Roles for EC2

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies is preparing to launch hundreds of production servers.

The Security Team has established the following requirements:

Every server must use encrypted storage.
All production servers must use a standard operating system.
Security tools must already be installed.
Company security policies must already be configured.
New servers should be deployable within minutes.

To achieve this, CloudNova will use:

Amazon EBS Encryption
AWS KMS
Custom Amazon Machine Images (AMIs)

🤔 What is Amazon EBS?

Amazon Elastic Block Store (EBS) is persistent block storage for EC2 instances.

Think of it as the hard disk attached to a virtual server.

An EBS volume stores:

Operating System
Applications
Configuration Files
Logs
Databases
User Data

Unlike the EC2 instance itself, an EBS volume can continue to exist even if the instance is stopped.

Amazon EBS Architecture

              Amazon EC2

                    │

          Amazon EBS Volume

                    │

          Encrypted Data Storage

Why Encrypt EBS?

Imagine someone gains unauthorised access to an EBS snapshot.

Without encryption:

Snapshot

↓

Read Data

↓

Sensitive Information Exposed

With encryption:

Encrypted Snapshot

↓

Encrypted Data

↓

AWS KMS Key Required

Even if the snapshot is copied, the data remains protected.

Benefits of EBS Encryption

✅ Data protected at rest

✅ Automatic encryption

✅ Snapshot encryption

✅ Integrated with AWS KMS

✅ Minimal performance impact

✅ Supports compliance requirements

What is AWS KMS?

AWS Key Management Service (KMS) manages encryption keys used by AWS services.

KMS provides:

Secure key storage
Automatic key rotation (configurable)
Access control
Audit logging
Encryption and decryption operations

Encryption Workflow

Application

↓

Amazon EC2

↓

Amazon EBS

↓

AWS KMS

↓

Encrypted Storage

The application does not manage encryption keys directly.

AWS handles encryption transparently.

Default AWS Managed Key

AWS automatically provides:

aws/ebs

This AWS managed key is suitable for many environments.

Large enterprises often create customer managed KMS keys (CMKs) to gain more control over:

Key rotation
Access permissions
Audit requirements
Separation of duties

Types of EBS Volumes

Volume	Use Case
gp3	General purpose workloads
io2	High-performance databases
st1	Throughput-intensive workloads
sc1	Cold storage workloads

CloudNova standard:

gp3

for application servers.

What is an AMI?

An Amazon Machine Image (AMI) is a template used to launch EC2 instances.

An AMI contains:

Operating System
Installed Software
Security Configuration
System Updates
Application Packages
Boot Configuration

Instead of configuring every server manually, organisations deploy from a standard AMI.

AMI Architecture

Amazon Linux

↓

Security Updates

↓

Monitoring Agent

↓

CloudWatch Agent

↓

Security Tools

↓

Create AMI

↓

Launch New Servers

Why Enterprises Use Custom AMIs

CloudNova builds a standard server image.

Every server already includes:

Amazon Linux
Latest patches
CloudWatch Agent
Systems Manager Agent
Security monitoring tools
Company configurations
Approved software

This ensures every server starts from a trusted baseline.

CloudNova Secure Image

CloudNova-Secure-AMI-v1

├── Amazon Linux 2023
├── Latest Security Updates
├── CloudWatch Agent
├── Systems Manager Agent
├── Security Policies
├── Company Banner
├── Monitoring Scripts
└── Approved Packages

New servers launched from this AMI are consistent and easier to manage.

Difference Between Snapshots and AMIs

Snapshot	AMI
Backup of an EBS volume	Complete server template
Stores storage data	Stores OS, configuration and storage mapping
Used for recovery	Used for deployment
Can exist independently	May reference one or more snapshots

Enterprise Image Lifecycle

Launch Base Server

↓

Install Updates

↓

Install Security Tools

↓

Configure Policies

↓

Test

↓

Create AMI

↓

Launch Production Servers

This process helps maintain a standard operating environment.

🛠 Lab 01 — Verify EBS Encryption

Open:

AWS Console

↓

EC2

↓

Instances

↓

CloudNova-App-Server-01

Select:

Storage

↓

Volume ID

Review:

Volume Type
Encryption Status
Size
KMS Key

Confirm that encryption is enabled.

🛠 Lab 02 — Create an Encrypted EBS Volume

Navigate to:

EC2

↓

Elastic Block Store

↓

Volumes

↓

Create Volume

Configure:

Setting	Value
Volume Type	gp3
Size	10 GiB
Availability Zone	Same as EC2 Instance
Encryption	Enabled
KMS Key	aws/ebs

Click:

Create Volume

🛠 Lab 03 — Attach the Volume

Select:

Volume

↓

Actions

↓

Attach Volume

Choose:

CloudNova-App-Server-01

Device Name:

/dev/sdf

Attach the volume.

🛠 Lab 04 — Verify the Volume

Connect to the EC2 instance.

Run:

lsblk

Expected:

xvda

xvdf

The new encrypted volume should be visible.

🛠 Lab 05 — Create a Snapshot

Navigate to:

Volumes

↓

Actions

↓

Create Snapshot

Name:

CloudNova-App-Snapshot

Verify the snapshot inherits encryption from the source volume.

🛠 Lab 06 — Create a Custom AMI

Navigate to:

EC2

↓

Instances

↓

CloudNova-App-Server-01

↓

Actions

↓

Image and Templates

↓

Create Image

Configure:

Name:

CloudNova-Secure-AMI-v1

Description:

Enterprise Secure Gold Image

Click:

Create Image

AWS creates the required snapshots and registers the AMI.

🛠 Lab 07 — Launch an EC2 Instance from the AMI

Navigate to:

EC2

↓

AMIs

↓

CloudNova-Secure-AMI-v1

↓

Launch Instance

Verify:

Applications are present.
Security configuration is retained.
Monitoring agents are installed.
Storage remains encrypted.

💻 AWS CLI Lab

Describe Volumes

aws ec2 describe-volumes

Create an Encrypted Volume

aws ec2 create-volume \
    --availability-zone ap-south-1a \
    --size 10 \
    --volume-type gp3 \
    --encrypted

Attach a Volume

aws ec2 attach-volume \
    --volume-id vol-xxxxxxxx \
    --instance-id i-xxxxxxxx \
    --device /dev/sdf

Describe Snapshots

aws ec2 describe-snapshots \
    --owner-ids self

Create an AMI

aws ec2 create-image \
    --instance-id i-xxxxxxxx \
    --name CloudNova-Secure-AMI-v1

Describe AMIs

aws ec2 describe-images \
    --owners self

✅ Verification

Verify:

✔ EBS volume is encrypted.

✔ Correct KMS key is used.

✔ Snapshot is created successfully.

✔ Custom AMI is available.

✔ EC2 instance launches successfully from the AMI.

✔ Applications and configuration are retained.

🔍 Troubleshooting

Problem

Volume cannot be attached.

Check:

Availability Zone matches the EC2 instance.
Volume state is Available.
Correct device name is used.

Problem

AMI creation fails.

Verify:

EC2 instance is in a stable state.
Required IAM permissions exist.
AWS service limits are not exceeded.

Problem

Encryption disabled.

Review:

EBS encryption settings.
Selected KMS key.
Default EBS encryption configuration for the AWS account.

Problem

Snapshot unavailable.

Check:

Snapshot creation status.
IAM permissions.
AWS Region.

🏢 Enterprise Best Practices

CloudNova standards:

Encrypt every EBS volume.
Enable default EBS encryption at the account level.
Use customer managed KMS keys for sensitive production workloads where organisational policy requires it.
Build and maintain approved Gold AMIs.
Patch AMIs regularly.
Remove outdated AMIs.
Test AMIs before production deployment.
Tag AMIs with version numbers.
Automate image creation where possible.

🚫 Common Mistakes

❌ Launching unencrypted EBS volumes.

❌ Creating production servers from outdated AMIs.

❌ Forgetting to update Gold Images.

❌ Using different operating system versions across servers without a documented reason.

❌ Leaving unused AMIs and snapshots unmanaged.

❌ Not testing custom AMIs before deployment.

🧪 DIY Challenge

Create your own secure enterprise image.

Requirements:

Amazon Linux 2023
Latest operating system updates
CloudWatch Agent installed
Systems Manager Agent verified
EBS encryption enabled
Enterprise tags applied

Create:

CloudNova-Gold-Image-v1

Then:

Launch a second EC2 instance from the new AMI.
Compare it with the original server.
Verify that encryption, software and configuration are consistent.

Capture screenshots of:

EBS Volume
Encryption Details
Snapshot
Custom AMI
EC2 Instance launched from the AMI
AWS CLI outputs

📊 Knowledge Check

What is Amazon EBS?
Why should EBS volumes be encrypted?
What role does AWS KMS play in EBS encryption?
What is the difference between an EBS Snapshot and an AMI?
Why do enterprises build custom AMIs?
What information is stored in an AMI?
Which EBS volume type is commonly used for general-purpose workloads?
Why should Gold Images be updated regularly?
Which AWS CLI command creates an AMI?
How does EBS encryption help protect sensitive business data?

💡 Key Takeaways

After completing this lesson, you should understand:

Amazon EBS provides persistent storage for EC2 instances and should be encrypted to protect data at rest.
AWS KMS manages the encryption keys used by EBS, helping organisations meet security and compliance requirements.
Amazon Machine Images (AMIs) provide a repeatable and consistent method for deploying secure EC2 instances.
Custom Gold AMIs improve standardisation, reduce deployment time and support enterprise operational practices.
Combining encrypted EBS volumes with well-maintained AMIs creates a secure foundation for production compute environments.

🚀 Next Lesson

➡️ Lesson 07 — AWS Systems Manager & Session Manager