Instructor: All right, finally, let's talk about
the last operation,
which is how do you encrypt an EBS volume?
So, when you created and encrypted EBS volume,
right away you get the following, you get data
at rest being encrypted inside your volume,
all the data in flight between the instance
and the volume is encrypted,
all the snapshots will be encrypted, and all the volumes
created from the snapshots are encrypted.
So, there's encryption all around the place,
and the all encryption and decryption mechanism
is handled transparently for you.
So, you have nothing to do.
It's all handled by EC2 and EBS behind the scenes.
So, encryption overall, something you should use
because it has a very, very minimal impact on latency,
almost nothing, and it leverages keys from KMS,
so AES-256, that's something that you should know.
And so, when you copy an unencrypted snapshot,
then you enable encryption.
So, let's talk about a very important thing,
which is how do you encrypt an unencrypted EBS volumes.
So, to encrypt an unencrypted EBS volumes,
which is a very tough thing to say,
you create an EBS snapshot of the volume.
Then you encrypt the EBS snapshot using the copy function.
Then we create a new EBS volume from the snapshots
and that volume will also be encrypted,
and now we can attach the encrypted volume
to the original instance.
So, let's go have a look at how we do this in the console.
Okay, so let's explore the different options
with EBS volumes and encryption.
So, let's create a one gigabytes EBS volume,
and this one will not be encrypted.
So, I will leave this setting unchecked,
and, therefore, when I create my volume
and have a look at it, if we look at the state
of encryption, it says not encrypted.
Okay, so what's happening is that if we do take to create
a snapshot from this volume, as we can see
the encryption setting will be set to not encrypted.
So, any snapshots encrypted from a non-encrypted EBS volume,
will be not encrypted.
So, let's go ahead and create this snapshots,
and let's go ahead to the snapshots page.
And so, this snapshot, as we observe is not encrypted.
And so, to create an encrypted snapshot,
now, what you have to do is to do action
and then create copy snapshot, excuse me,
and when you copy the snapshots,
you have the option right here to enable encryption
into the same destination region.
So, now, this snapshot is going to be encrypted
and you can select the KMS key, right here.
So, we'll copy this snapshots and we're good.
Next, what I have to do is from this encrypted snapshots
that is now completed I can create a volume.
And if I do action, create volume from snapshots,
as we can see, we can create a one gigabyte EBS volume.
And here encryption is enabled for this volume
because my underlying snapshot is encrypted.
And, therefore, if I click on create volume,
and have a look at my volumes on the left hand side,
this one who was created from a snapshots
is now available and it says encryption, encrypted.
So, that's good.
We saw how we can encrypt one EBS volume this way,
by going through a snapshot copying and so on.
There's a shortcut.
So, if you take your unencrypted snapshot,
so this one is not encrypted,
so if you take this snapshot and then you do action,
create volumes from snapshot, zero shortcuts,
you can actually on the fly enable encryption
for the EBS volume directly from here, select an EBS key,
and you would create an encrypted EBS volume this way
through a unencrypted snapshots.
Okay, so let's say you've seen all the options.
Just to be finished make sure to delete your snapshots
by typing deletes and then you would do
the exact same thing on your volumes.
Just delete these EBS volumes.
Okay, that's it.
I hope you liked it, and I will see you in the next lecture.