AWS Auto Scaling Launch Configuration Encrypted EBS Cloud Formation Example

Question

I am creating cloud formation script, which will have ELB. In Auto Scaling launch configuration, I want to add encrypted EBS volume. Couldn't find an encrypted property withing blockdevicemapping. I need to encrypt volume. How can I attach an encrypted EBS volume to an EC2 instance through auto scaling launch configuration?

Answer 1

There is no such property for some strange reason when using launch configurations, however it is there when using blockdevicemappings with simple EC2 instances. See launchconfig-blockdev vs ec2-blockdev

So you'll either have to use simple instances instead of autoscaling groups, or you can try this workaround:

SnapshotIds are accepted for launchconf blockdev too, and as stated here "Snapshots that are taken from encrypted volumes are automatically encrypted. Volumes that are created from encrypted snapshots are also automatically encrypted."

Create a snapshot from an encrypted empty EBS volume and use it in the CloudFormation template. If your template should work in multiple regions then of course you'll have to create the snapshot in every region and use a Mapping in the template.