Discuss EBS encryption.
EBS encryption provides transparent AES-256 encryption for data at rest on EBS volumes, data in transit between the volume and the EC2 instance, all snapshots, and all volumes created from those snapshots. Encryption is handled by AWS KMS keys and has minimal impact on performance.
EBS encryption is a fully managed, transparent encryption solution. Once enabled, encryption and decryption happen automatically — your application and OS do not need to be modified. The encryption keys are managed by AWS KMS (Key Management Service), and all cryptographic operations happen on the EC2 host hardware (on Nitro instances), resulting in near-zero performance impact.
- 1
Data at rest — all data stored on the EBS volume is encrypted on disk
- 2
Data in transit — data moving between the EC2 instance and the EBS volume over the internal AWS network is encrypted
- 3
Snapshots — all snapshots taken from an encrypted volume are automatically encrypted
- 4
New volumes from snapshots — volumes created from an encrypted snapshot are automatically encrypted
- 5
Cross-account shared snapshots — encryption is preserved when sharing encrypted snapshots
- 1
AWS-managed key (aws/ebs) — default KMS key managed by AWS, no additional cost for key storage
- 2
Customer-managed key (CMK) — your own KMS key, giving you full control over key rotation, access policies, and auditing via CloudTrail. Additional KMS key cost applies.
- 3
Key rotation — AWS-managed keys are automatically rotated annually. Customer-managed keys can be set to auto-rotate annually or rotated manually.
- 1
You CANNOT encrypt an existing unencrypted volume directly — instead: take a snapshot → copy the snapshot with encryption enabled → create a new encrypted volume from the encrypted snapshot
- 2
You CANNOT turn off encryption on an encrypted volume
- 3
Encrypted snapshots can be shared but the recipient must have access to the KMS key used for encryption
- 4
Enable encryption by default at the account level so all new EBS volumes are automatically encrypted
- 5
There is no performance penalty for encryption on Nitro-based EC2 instances — AES-256 is accelerated in hardware
Scenario Questions
0-2 years experience
- 1If you launch an EC2 instance with a new EBS volume and enable encryption, what steps does AWS take to ensure the data is encrypted at rest?
- 2How would you verify that an existing unencrypted EBS volume is now encrypted without losing data?
- 3What happens if you try to attach an encrypted volume to an instance in a different AWS account?
2-5 years experience
- 1Your application is experiencing latency spikes after you enabled encryption on several large EBS volumes. How would you investigate the cause?
- 2You have a snapshot of an encrypted volume and need to restore it in a different region. What considerations and steps are required?
- 3During a deployment, a Terraform plan fails when trying to enable encryption on a volume that already contains data. Why does this happen and how would you resolve it?
5-8 years experience
- 1Design a strategy to migrate a fleet of production databases from unencrypted to encrypted EBS volumes with minimal downtime. What trade‑offs do you consider?
- 2Explain how you would implement key rotation for EBS volumes encrypted with a customer‑managed CMK, and what impact it has on existing data.
- 3Your team wants to use encrypted EBS for a high‑throughput analytics workload. How would you assess performance impact and mitigate any bottlenecks?
8+ years experience
- 1At a large enterprise, multiple teams use shared AMIs that reference encrypted root volumes with different KMS keys. How would you standardize encryption policies while preserving team autonomy?
- 2You need to de‑commission an old AWS account and move all encrypted EBS snapshots to a new account without exposing plaintext data. Outline the migration plan and security checks.
- 3Discuss the long‑term operational implications of using AWS‑managed keys versus customer‑managed keys for EBS encryption across a multi‑region, multi‑account environment.
Follow-up Questions
- Can you walk me through the exact API calls involved?
- What monitoring would you put in place to detect encryption‑related issues?
- How would you handle a situation where the KMS key is disabled?