Encrypt root volume of EC2 while creating stack using cloud formation

Question

Working on cloud formation script which will create simple ec2 instance. here i want to encrypt a root volume at the time of launch. its possible to create a separate EBS, encrypt it and attach it as boot volume. but i couldn't find a way to encrypt it while launching. any way to do this?

Thanks In Advance

Answer 1

It looks like AWS has recently released a feature to launch an instance with encrypted volume based on non-encrypted AMI. Launch encrypted EBS backed EC2 instances from unencrypted AMIs in a single step

From the CloudFormation perspective, you need to overwrite AMI block device configuration. So for example, you can write like this:

  BlockDeviceMappings:
  - DeviceName: "/dev/xvda"
    Ebs:
      VolumeSize: '8'
      Encrypted: 'true'

This will start an instance with encrypted root EBS from non-encrypted AMI with a default KMS key