AWS ebs medium security documentation change
Summary
Added requirements for EBS volume attachment including Availability Zone matching, volume state, encryption compatibility, and explicit failure condition for exceeding volume limits. Added warning about accidental root volume boot scenarios. Consolidated documentation sections and added concrete CLI/PowerShell examples.
Security assessment
The change adds explicit documentation about encrypted volume attachment restrictions ('If the volume is encrypted, it can only be attached to instance types that support Amazon EBS encryption'), which directly relates to security controls. The warning about accidental root volume boot scenarios addresses a potential misconfiguration risk that could lead to unintended data access or system behavior. However, there is no evidence of addressing an active security vulnerability.
Diff
diff --git a/ebs/latest/userguide/ebs-attaching-volume.md b/ebs/latest/userguide/ebs-attaching-volume.md index e9ca9113a..348f8bc82 100644 --- a//ebs/latest/userguide/ebs-attaching-volume.md +++ b//ebs/latest/userguide/ebs-attaching-volume.md @@ -13 +13,7 @@ For information about adding EBS volumes to your instance at launch, see [instan - * Determine how many volumes you can attach to your instance. The maximum number of Amazon EBS volumes that you can attach to an instance depends on the instance type and instance size. For more information, see [ Instance volume limits](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/volume_limits.html). + * You must attach a volume to an instance in the same Availability Zone as the volume. + + * The volume must be in the `Available` state. + + * If the volume is encrypted, it can only be attached to instance types that support Amazon EBS encryption. For more information, see [Amazon EBS encryption](./ebs-encryption.html). + + * Determine how many volumes you can attach to your instance. The maximum number of Amazon EBS volumes that you can attach to an instance depends on the instance type and instance size. If you attempt to attach a number of volumes that exceeds the instance type's volume limit, the request fails. For more information, see [Instance volume limits](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/volume_limits.html). @@ -28,0 +35 @@ For information about adding EBS volumes to your instance at launch, see [instan + * In some situations, you might find that a volume other than the volume attached to `/dev/xvda` or `/dev/sda` has become the root volume of your instance. This can happen when you have attached the root volume of another instance, or a volume created from the snapshot of a root volume, to an instance with an existing root volume. For more information, see [Boot from the wrong volume](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-booting-from-wrong-volume.html). @@ -32 +38,0 @@ For information about adding EBS volumes to your instance at launch, see [instan -You can attach a volume to an instance using one of the following methods. @@ -37 +43 @@ Console -###### To attach an EBS volume to an instance using the console +###### To attach an EBS volume to an instance @@ -45,4 +50,0 @@ Console -###### Note - -You can attach only volumes that are in the `Available` state. - @@ -51,6 +52,0 @@ You can attach only volumes that are in the `Available` state. -###### Note - - * The volume must be attached to an instance in the same Availability Zone. - - * If the volume is encrypted, it can only be attached to instance types that support Amazon EBS encryption. For more information, see [Amazon EBS encryption](./ebs-encryption.html). - @@ -77 +73 @@ AWS CLI -###### To attach an EBS volume to an instance using the AWS CLI +###### To attach an EBS volume to an instance @@ -79 +75 @@ AWS CLI -Use the [attach-volume](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/attach-volume.html) command. +Use the [attach-volume](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/attach-volume.html) command. The following example attaches the specified volume to the specified instance using the specified device name. @@ -81 +76,0 @@ Use the [attach-volume](https://awscli.amazonaws.com/v2/documentation/api/latest -PowerShell @@ -82,0 +78,4 @@ PowerShell + aws ec2 attach-volume \ + --volume-id vol-01234567890abcdef \ + --instance-id i-1234567890abcdef0 \ + --device /dev/sdf @@ -84,5 +83 @@ PowerShell -###### To attach an EBS volume to an instance using the Tools for Windows PowerShell - -Use the [Add-EC2Volume](https://docs.aws.amazon.com/powershell/latest/reference/items/Add-EC2Volume.html) command. - -###### Note +PowerShell @@ -90 +84,0 @@ Use the [Add-EC2Volume](https://docs.aws.amazon.com/powershell/latest/reference/ - * If you attempt to attach a number of volumes that exceeds the instance type's volume limit, the request fails. For more information, see [ Instance volume limits](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/volume_limits.html). @@ -92 +86 @@ Use the [Add-EC2Volume](https://docs.aws.amazon.com/powershell/latest/reference/ - * In some situations, you may find that a volume other than the volume attached to `/dev/xvda` or `/dev/sda` has become the root volume of your instance. This can happen when you have attached the root volume of another instance, or a volume created from the snapshot of a root volume, to an instance with an existing root volume. For more information, see [Boot from the wrong volume](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-booting-from-wrong-volume.html). +###### To attach an EBS volume to an instance @@ -93,0 +88 @@ Use the [Add-EC2Volume](https://docs.aws.amazon.com/powershell/latest/reference/ +Use the [Add-EC2Volume](https://docs.aws.amazon.com/powershell/latest/reference/items/Add-EC2Volume.html) cmdlet. The following example attaches the specified volume to the specified instance using the specified device name. @@ -95,0 +91,4 @@ Use the [Add-EC2Volume](https://docs.aws.amazon.com/powershell/latest/reference/ + Add-EC2Volume ` + -VolumeId vol-01234567890abcdef ` + -InstanceId i-1234567890abcdef0 ` + -Device /dev/sdf