Encrypting a new EBS volume

To encrypt a new EBS volume, follow these simple steps:

1. From the AWS Management Console, select EC2 from the Compute category.
2. Select Volumes from the ELASTIC BLOCK STORE menu on the left:

3. Select Create Volume to arrive at the following screen:

4. Select your desired Volume Type, Size (GiB), and Availability Zone options. To apply encryption, select the checkbox beside Encryption, and this will provide you with additional options:

5. You first need to select your Master Key setting, which is effectively your CMK. If you have already created a customer-managed CMK within KMS, then you can select that key here. Alternatively, you can select an AWS-managed key instead. In the preceding example, I have chosen to select an AWS-managed key, which is automatically created by KMS for use with EBS only.

Note that the data keys generated and encrypted by the CMK are stored alongside the encrypted data on your volumes. This data key is also ...