AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2026-02-13 · Documentation low

File: AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md

Summary

Updated documentation for EBS volumes: Changed update requirements to 'not supported', increased max throughput to 2000 MiB/s, added ratio explanation, and added new example for encrypted gp3 volume with initialization rate.

Security assessment

The change adds documentation about volume encryption using KMS keys, which is a security feature. However, there's no evidence this addresses a specific security vulnerability.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md
index e8bd846c1..032a3d618 100644
--- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md
+++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md
@@ -127 +127 @@ _Required_ : No
- _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+ _Update requires_ : Updates are not supported.
@@ -293 +293 @@ _Required_ : No
-The throughput to provision for a volume, with a maximum of 1,000 MiB/s.
+The throughput to provision for a volume, with a maximum of 2,000 MiB/s.
@@ -297 +297,3 @@ This parameter is valid only for `gp3` volumes. The default value is 125.
-Valid Range: Minimum value of 125. Maximum value of 1000.
+Valid Range: Minimum value of 125. Maximum value of 2000.
+
+The maximum ratio of throughput to IOPS is 0.25 MiB/s per IOPS. For example, a volume with 3,000 IOPS can have a maximum throughput of 750 MiB/s (3,000 x 0.25).
@@ -395,0 +398,2 @@ The ID of the volume.
+  * Volume from snapshot with encryption and initialization rate
+
@@ -461,0 +466,100 @@ The following example creates a 100 GiB `io1` with `100` provisioned IOPS.
+### Volume from snapshot with encryption and initialization rate
+
+The following example creates an encrypted `gp3` volume from a snapshot. The volume specifies a volume initialization rate for predictable initialization performance.
+
+#### JSON
+    
+    
+    {
+      "AWSTemplateFormatVersion": "2010-09-09",
+      "Description": "Create an encrypted gp3 volume from a snapshot",
+      "Parameters": {
+        "SnapshotId": {
+          "Type": "String",
+          "Description": "The ID of the snapshot to create the volume from"
+        },
+        "KmsKeyId": {
+          "Type": "String",
+          "Description": "The ARN of the KMS key for volume encryption"
+        }
+      },
+      "Resources": {
+        "SnapshotVolume": {
+          "Type": "AWS::EC2::Volume",
+          "Properties": {
+            "AvailabilityZone": {
+              "Fn::Select": [
+                "0",
+                {
+                  "Fn::GetAZs": ""
+                }
+              ]
+            },
+            "SnapshotId": {
+              "Ref": "SnapshotId"
+            },
+            "VolumeType": "gp3",
+            "Size": 100,
+            "Iops": 3000,
+            "Throughput": 125,
+            "Encrypted": true,
+            "KmsKeyId": {
+              "Ref": "KmsKeyId"
+            },
+            "VolumeInitializationRate": 100,
+            "Tags": [
+              {
+                "Key": "Name",
+                "Value": "SnapshotRestoredVolume"
+              }
+            ]
+          },
+          "DeletionPolicy": "Snapshot"
+        }
+      },
+      "Outputs": {
+        "VolumeId": {
+          "Value": {
+            "Ref": "SnapshotVolume"
+          },
+          "Description": "The ID of the created volume"
+        }
+      }
+    }
+
+#### YAML
+    
+    
+    AWSTemplateFormatVersion: '2010-09-09'
+    Description: Create an encrypted gp3 volume from a snapshot
+    Parameters:
+      SnapshotId:
+        Type: String
+        Description: The ID of the snapshot to create the volume from
+      KmsKeyId:
+        Type: String
+        Description: The ARN of the KMS key for volume encryption
+    Resources:
+      SnapshotVolume:
+        Type: AWS::EC2::Volume
+        Properties:
+          AvailabilityZone: !Select
+            - 0
+            - !GetAZs ''
+          SnapshotId: !Ref SnapshotId
+          VolumeType: gp3
+          Size: 100
+          Iops: 3000
+          Throughput: 125
+          Encrypted: true
+          KmsKeyId: !Ref KmsKeyId
+          VolumeInitializationRate: 100
+          Tags:
+            - Key: Name
+              Value: SnapshotRestoredVolume
+        DeletionPolicy: Snapshot
+    Outputs:
+      VolumeId:
+        Value: !Ref SnapshotVolume
+        Description: The ID of the created volume
+