{"id":113,"date":"2017-04-26T10:18:08","date_gmt":"2017-04-26T18:18:08","guid":{"rendered":"http:\/\/nerdsector.com\/ns\/?p=113"},"modified":"2017-04-26T14:34:18","modified_gmt":"2017-04-26T22:34:18","slug":"launch-aws-linux-instance-using-encrypted-boot-volumes","status":"publish","type":"post","link":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/","title":{"rendered":"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes"},"content":{"rendered":"<p>Using encrypted boot volumes for AWS Linux Instances is not very well documented. \u00a0 Here is a how to for launching a AWS Linux instance using encrypted boot volumes.<\/p>\n<p>Note that encryption has a performance impact on the instance, and thus it will require a larger instance size to run. \u00a0You will not be able to get a t2.micro instance to boot as it does not have enough CPU performance.<\/p>\n<p>The process is broken down into 4 steps<\/p>\n<ol>\n<li>Create a Role for the EC2 instance to access encryption keys<\/li>\n<li>Create the Encryption key<\/li>\n<li>Create a custom AMI using your Encryption key<\/li>\n<li>Launch the Instance using your custom AMI.<\/li>\n<\/ol>\n<p>All the instances launched from the custom AMI will use the same encryption key. \u00a0Create another custom AMI if you need different encryption keys.<\/p>\n<p>&nbsp;<\/p>\n<h3>Step 1: Create a\u00a0IAM role which will be used by the EC2 instance. \u00a0(Used to access encryption keys to boot etc.)<\/h3>\n<ul>\n<li>Sign in to the IAM console at\u00a0<a href=\"https:\/\/console.aws.amazon.com\/iam\/\"><strong>https:\/\/console.aws.amazon.com\/iam\/<\/strong><\/a>.<\/li>\n<li>In the navigation pane of the IAM console, click\u00a0<strong>Roles<\/strong>, and then click\u00a0<strong>Create New Role<\/strong>.<\/li>\n<li>For\u00a0<strong>Role name<\/strong>, type a role name that can help you identify the purpose of this role. Role names must be unique within your AWS account. After you type the name, click\u00a0<strong>Next Step<\/strong>\u00a0at the bottom of the page.<\/li>\n<\/ul>\n<p style=\"padding-left: 60px;\"><strong>Important<\/strong><\/p>\n<p style=\"padding-left: 60px;\">Role names must be unique within an account. They are not distinguished by case, for example, you cannot create roles named both &#8220;PRODROLE&#8221; and &#8220;prodrole&#8221;.<\/p>\n<ul>\n<li>Expand the\u00a0<strong>AWS Service Roles<\/strong>\u00a0section, and then select the <strong>Amazon EC2<\/strong> click <strong>Select.<\/strong><\/li>\n<li>Click\u00a0<strong>Next Step<\/strong>\u00a0to review the role. Then click\u00a0<strong>Create Role<\/strong>.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3>Step 2: Create a EBS encryption key to be used to encrypt the target\u00a0&lt;instance_name&gt; volumes.<\/h3>\n<ul>\n<li>Sign in to the AWS Management Console and open the Amazon RDS console at <a href=\"https:\/\/console.aws.amazon.com\/iam\/\"><strong>https:\/\/console.aws.amazon.com\/iam\/<\/strong><\/a>.<\/li>\n<li>In the top right corner of the Amazon RDS console, choose the region in which you want to create the encryption key<\/li>\n<li>In the navigation pane, choose\u00a0<strong>Encryption Keys<\/strong>.<\/li>\n<li>Click <strong>Create Key.<\/strong><\/li>\n<li>Enter a name for the encryption key in the Alias field.\u00a0 Example: &lt;instance_name&gt;_ebs_key<\/li>\n<li>Enter a description for the encryption key. Example: EBS encryption key for the &lt;instance_name&gt;<\/li>\n<li>Click <strong>Next Step<\/strong><\/li>\n<li>Add tag meta data<\/li>\n<li>Click <strong>Next Step<\/strong><\/li>\n<li>\u00a0In the Key Administrators field, select the users and or roles who will have administrative rights to administer the key.<\/li>\n<li>Click <strong>Next Step<\/strong><\/li>\n<li>In the <strong>Define Key Usage Permissions \u2013 This Account <\/strong>\u00a0Select the &lt;instance_name&gt;\u00a0<strong>role<\/strong> you created above<\/li>\n<li>Click <strong>Next Step<\/strong><\/li>\n<li>Review the Key Policy and if acceptable, click<strong> Finish.\u00a0<\/strong><\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3>Step 3: Create a custom AMI based on the current Amazon Linux AMI which contains encrypted volumes\/snapshots.<\/h3>\n<p>This will allow for encrypted volumes on the target instance.<\/p>\n<ul>\n<li>Locate the latest Amazon Linux AMI in your region by attempting to launch a new EC2 instance.<\/li>\n<li>From EC2 Console, Click <strong>Launch Instance<\/strong>. The latest current Amazon Linux AMI will be listed at the top of the Quick Start List. Copy the ami-xxxxxxx number.<\/li>\n<li>From the EC2 Console, Select <strong>AMIs<\/strong> from the left navigator.<\/li>\n<li>Paste in the copied ami-xxxxxx into the search filter<\/li>\n<li>Choose <strong>Actions &gt; Copy AMI,<\/strong> select the <strong>Destination region<\/strong> and check the <strong>Encryption<\/strong> checkbox option<\/li>\n<li>For Master Key choose the EBS encryption key you created above and assigned to the target\u00a0instance role you created in step 1.<\/li>\n<li>Click <strong>Copy AMI<\/strong>.<\/li>\n<li>The AMI is being copied to your account using the encrypted volumes\/snapshots.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3>Step 4: Launch a Linux Instance using the custom AMI with your Encrypted EBS Volumes<\/h3>\n<ul>\n<li>Sign in to the AWS Management Console and open the Amazon EC2 console at <a href=\"https:\/\/console.aws.amazon.com\/ec2\/\"><strong>https:\/\/console.aws.amazon.com\/ec2\/<\/strong><\/a>.<\/li>\n<li>In the top right corner of the Amazon EC2 console, choose the region in which you want to create the new EC2 instance.<\/li>\n<li>In the navigation pane, choose <strong>Instances<\/strong>.<\/li>\n<li>Click the <strong>Launch Instance<\/strong><\/li>\n<li>Choose the custom\u00a0Linux AMI you created in Step 3<\/li>\n<li>Choose the instance type and click <strong>Next: Configure Instance Details<\/strong><\/li>\n<li><strong>NOTE:<\/strong> Encrypted EBS volumes requires a larger instance size due to the encryption\/decryption overhead. \u00a0A m3.large or larger is recommended.<\/li>\n<li>Set the Network, Subnet-Availability Zone, and Auto-assign Public IP options as required.<\/li>\n<li>For IAM role, choose the Instance Role you created in step 1 above.<\/li>\n<li>Set the Shutdown behavior to Stop, and check the <strong>Protect against accidental termination<\/strong> box to enable termination protection on the instance.<\/li>\n<li>Click <strong>Next: Add Storage <\/strong>to proceed to the next step.<\/li>\n<li>Review the default EBS volume configuration of 8 GB root volume using general purpose SSD.\u00a0 Adjust the volume size if needed and click <strong>Next: Add Tags<\/strong>.<\/li>\n<li>Click <strong>Next: Configure Security Group.<\/strong><\/li>\n<li>Assign an existing Security Group or create a new Security Group as needed. Click <strong>Review and Launch<\/strong>.<\/li>\n<li>Review the instance settings and Click <strong>Launch<\/strong> to launch the instance.<\/li>\n<li>On the Select an existing ssh key pair or create a new key pair screen, either create a new ssh key or assign an existing key pair. Click <strong>Launch<\/strong> Instances to launch the new instance.<\/li>\n<li>Wait for the new instance to launch and connect to instance to verify.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Using encrypted boot volumes for AWS Linux Instances is not very well documented. \u00a0 Here is a how to for launching a AWS Linux instance using encrypted boot volumes. Note that encryption has a performance impact on the instance, and thus it will require a larger instance size to run. \u00a0You will not be able &hellip; <a href=\"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;How to: Launch a AWS Linux Instance using Encrypted Boot Volumes&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[22],"tags":[23,24,25,26],"class_list":["post-113","post","type-post","status-publish","format-standard","hentry","category-aws","tag-aws","tag-aws-ebs-encrypted-boot-volume","tag-ec2","tag-ec2-ebs"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to: Launch a AWS Linux Instance using Encrypted Boot Volumes - Nerdsector.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes - Nerdsector.com\" \/>\n<meta property=\"og:description\" content=\"Using encrypted boot volumes for AWS Linux Instances is not very well documented. \u00a0 Here is a how to for launching a AWS Linux instance using encrypted boot volumes. Note that encryption has a performance impact on the instance, and thus it will require a larger instance size to run. \u00a0You will not be able &hellip; Continue reading &quot;How to: Launch a AWS Linux Instance using Encrypted Boot Volumes&quot;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/\" \/>\n<meta property=\"og:site_name\" content=\"Nerdsector.com\" \/>\n<meta property=\"article:published_time\" content=\"2017-04-26T18:18:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2017-04-26T22:34:18+00:00\" \/>\n<meta name=\"author\" content=\"mrcaution\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"mrcaution\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/\"},\"author\":{\"name\":\"mrcaution\",\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/#\\\/schema\\\/person\\\/c44c899761720267903204249c3cab2f\"},\"headline\":\"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes\",\"datePublished\":\"2017-04-26T18:18:08+00:00\",\"dateModified\":\"2017-04-26T22:34:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/\"},\"wordCount\":869,\"commentCount\":0,\"keywords\":[\"AWS\",\"AWS EBS Encrypted Boot Volume\",\"EC2\",\"EC2 EBS\"],\"articleSection\":[\"AWS\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/\",\"url\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/\",\"name\":\"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes - Nerdsector.com\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/#website\"},\"datePublished\":\"2017-04-26T18:18:08+00:00\",\"dateModified\":\"2017-04-26T22:34:18+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/#\\\/schema\\\/person\\\/c44c899761720267903204249c3cab2f\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nerdsector.com\\\/ns\\\/2017\\\/04\\\/26\\\/launch-aws-linux-instance-using-encrypted-boot-volumes\\\/\"]}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/#website\",\"url\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/\",\"name\":\"Nerdsector.com\",\"description\":\"Technology News, Tips and More\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/#\\\/schema\\\/person\\\/c44c899761720267903204249c3cab2f\",\"name\":\"mrcaution\",\"url\":\"https:\\\/\\\/nerdsector.com\\\/ns\\\/author\\\/mrcaution\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes - Nerdsector.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/","og_locale":"en_US","og_type":"article","og_title":"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes - Nerdsector.com","og_description":"Using encrypted boot volumes for AWS Linux Instances is not very well documented. \u00a0 Here is a how to for launching a AWS Linux instance using encrypted boot volumes. Note that encryption has a performance impact on the instance, and thus it will require a larger instance size to run. \u00a0You will not be able &hellip; Continue reading \"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes\"","og_url":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/","og_site_name":"Nerdsector.com","article_published_time":"2017-04-26T18:18:08+00:00","article_modified_time":"2017-04-26T22:34:18+00:00","author":"mrcaution","twitter_misc":{"Written by":"mrcaution","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/#article","isPartOf":{"@id":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/"},"author":{"name":"mrcaution","@id":"https:\/\/nerdsector.com\/ns\/#\/schema\/person\/c44c899761720267903204249c3cab2f"},"headline":"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes","datePublished":"2017-04-26T18:18:08+00:00","dateModified":"2017-04-26T22:34:18+00:00","mainEntityOfPage":{"@id":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/"},"wordCount":869,"commentCount":0,"keywords":["AWS","AWS EBS Encrypted Boot Volume","EC2","EC2 EBS"],"articleSection":["AWS"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/","url":"https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/","name":"How to: Launch a AWS Linux Instance using Encrypted Boot Volumes - Nerdsector.com","isPartOf":{"@id":"https:\/\/nerdsector.com\/ns\/#website"},"datePublished":"2017-04-26T18:18:08+00:00","dateModified":"2017-04-26T22:34:18+00:00","author":{"@id":"https:\/\/nerdsector.com\/ns\/#\/schema\/person\/c44c899761720267903204249c3cab2f"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nerdsector.com\/ns\/2017\/04\/26\/launch-aws-linux-instance-using-encrypted-boot-volumes\/"]}]},{"@type":"WebSite","@id":"https:\/\/nerdsector.com\/ns\/#website","url":"https:\/\/nerdsector.com\/ns\/","name":"Nerdsector.com","description":"Technology News, Tips and More","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nerdsector.com\/ns\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/nerdsector.com\/ns\/#\/schema\/person\/c44c899761720267903204249c3cab2f","name":"mrcaution","url":"https:\/\/nerdsector.com\/ns\/author\/mrcaution\/"}]}},"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p2Ldd1-1P","jetpack_likes_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/posts\/113","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/comments?post=113"}],"version-history":[{"count":4,"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/posts\/113\/revisions"}],"predecessor-version":[{"id":117,"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/posts\/113\/revisions\/117"}],"wp:attachment":[{"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/media?parent=113"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/categories?post=113"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nerdsector.com\/ns\/wp-json\/wp\/v2\/tags?post=113"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}