AWS AWSEC2 documentation change
Summary
Added documentation for replacing root volumes using existing EBS volumes, including requirements, encryption rules, and CLI/PowerShell examples.
Security assessment
The change documents encryption requirements when replacing root volumes (e.g., encrypted volumes cannot be replaced with unencrypted ones) and specifies IAM permissions needed for encrypted volume operations. However, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/AWSEC2/latest/UserGuide/replace-root.md b/AWSEC2/latest/UserGuide/replace-root.md index 911f1c36d..a25fd3c26 100644 --- a//AWSEC2/latest/UserGuide/replace-root.md +++ b//AWSEC2/latest/UserGuide/replace-root.md @@ -39 +39 @@ When you replace the root volume for an instance, we create _root volume replace -When you replace the root volume for an instance, you must specify the source of the snapshot for the new volume. The following are the possible options. +When you replace the root volume for an instance, you must specify the source for the new volume. The following are the possible options. @@ -111,0 +112,23 @@ The new AMI ID is also reflected in the instance metadata. +Unlike the snapshot and AMI options, which create a new volume, this option replaces the current root volume with an existing Amazon EBS volume that you have already configured. This is useful for stateful workloads, such as databases, where you want to prepare metadata or software on the root volume before you attach it to the instance. + +Before you use this option, you must create and prepare the replacement Amazon EBS volume. You can prepare it by attaching it to an instance as a data volume, copying the required data to it, and then detaching it. The volume must be in the same Availability Zone as the instance. + +The replacement root volume retains the size, type, and other attributes that you configured when you created and prepared it. The delete on termination attribute of the original root volume does not transfer to the replacement root volume. + +###### Considerations for using an existing Amazon EBS volume + + * The replacement volume must be in the same Availability Zone as the instance. + + * The replacement volume must not be attached to any instance at the time of the request. + + * The replacement volume must be in the `available` state. + + * If the replacement volume does not meet these requirements, the root volume replacement request fails. + + * You can use this option with AWS Marketplace instances, but both the marketplace product codes and the billing codes on the replacement volume must match those on the instance. + + * If the original root volume is encrypted, the replacement volume must also be encrypted. You can move from an unencrypted volume to an encrypted one, but not from encrypted to unencrypted. When the replacement volume is encrypted, your IAM principal must have the AWS KMS permissions required to detach the original volume. You must also have the permissions to attach and decrypt the replacement volume. These are the same permissions needed to attach an encrypted volume. + + + + @@ -149 +172 @@ Before you begin, consider the following. - * You can only use snapshots that were created directly from the instance's current or previous root volumes. + * When using a snapshot, you can only use snapshots that you created directly from the instance's current or previous root volumes. @@ -160 +183 @@ The following table summarizes the possible encryption outcomes. -| Original root volume | Specified snapshot or AMI | Encryption by default | Replacement root volume | Encryption key used for replacement root volume +| Original root volume | Specified snapshot, AMI, or volume | Encryption by default | Replacement root volume | Encryption key used for replacement root volume @@ -169,0 +193,4 @@ Unencrypted | Encrypted | Not considered | Encrypted | If the AMI or snapshot is +**Restore replacement root volume from an existing Amazon EBS volume** | Encrypted | Encrypted | Not applicable | Encrypted | KMS key of the specified volume +Encrypted | Unencrypted | Not applicable | Not allowed. You cannot replace an encrypted root volume with an unencrypted volume. Amazon EC2 rejects the replacement task. | Not applicable +Unencrypted | Unencrypted | Not applicable | Unencrypted | Not applicable +Unencrypted | Encrypted | Not applicable | Encrypted | KMS key of the specified volume @@ -243,0 +271,10 @@ Use the [ create-replace-root-volume-task](https://docs.aws.amazon.com/cli/lates +###### To replace the root volume using an existing Amazon EBS volume + +Use the [ create-replace-root-volume-task](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-replace-root-volume-task.html) command. For `--instance-id`, specify the ID of the instance for which to replace the root volume (for example, `i-1234567890abcdef0`). For `--volume-id`, specify the ID of the Amazon EBS volume to use as the new root volume. To delete the original root volume after the replacement completes, include `--delete-replaced-root-volume`. Amazon EC2 accepts the `--volume-initialization-rate` parameter but ignores it with this option because it does not download snapshot data. + + + aws ec2 create-replace-root-volume-task \ + --instance-id i-1234567890abcdef0 \ + --volume-id vol-0123456789abcdef0 \ + --delete-replaced-root-volume + @@ -300,0 +338,10 @@ Use the [New-EC2ReplaceRootVolumeTask](https://docs.aws.amazon.com/powershell/la +###### To replace the root volume using an existing Amazon EBS volume + +Use the [New-EC2ReplaceRootVolumeTask](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2ReplaceRootVolumeTask.html) command. For `-InstanceId`, specify the ID of the instance for which to replace the root volume (for example, `i-1234567890abcdef0`). For `-VolumeId`, specify the ID of the Amazon EBS volume to use as the new root volume. To delete the original root volume after the replacement completes, include `-DeleteReplacedRootVolume` and specify `$true`. Amazon EC2 accepts the `-VolumeInitializationRate` parameter but ignores it with this option because it does not download snapshot data. + + + New-EC2ReplaceRootVolumeTask ` + -InstanceId i-1234567890abcdef0 ` + -VolumeId vol-0123456789abcdef0 ` + -DeleteReplacedRootVolume $true +