用AWS加密EC2快照

Question

我试图使用AWS加密未加密的EC2快照。下面是它的工作原理：

1. we need to copy the unencrypted EC2 snapshot because we can't make a change in already existing snapshot.
2. while copying, we need to set encryption as encrypted and create it.
3. After creating the encrypted snapshot, delete the unencrypted snapshot.

这是我如何使用实现的：

 public static void encryptSnapshots(Ec2Client ec2, String snapshotId, String region, KmsClient kms){
        DescribeSnapshotsRequest describeSnapshotsRequest = DescribeSnapshotsRequest.builder().snapshotIds(snapshotId).build();
        DescribeSnapshotsResponse describeSnapshotsResponse = ec2.describeSnapshots(describeSnapshotsRequest);
        KeyUsageType keyUsageType = KeyUsageType.ENCRYPT_DECRYPT;
        CustomerMasterKeySpec customerMasterKeySpec = CustomerMasterKeySpec.SYMMETRIC_DEFAULT;
        OriginType originType = OriginType.AWS_KMS;
        CreateKeyRequest createKeyRequest = CreateKeyRequest.builder().keyUsage(keyUsageType).customerMasterKeySpec(customerMasterKeySpec).origin(originType).build();
        CreateKeyResponse createKeyResponse = kms.createKey(createKeyRequest);
        String kmsId = createKeyResponse.keyMetadata().keyId();
        for(Snapshot snapshot: describeSnapshotsResponse.snapshots()){
            if(!snapshot.encrypted()){
                try{
                    CopySnapshotRequest copySnapshotRequest = CopySnapshotRequest.builder().sourceSnapshotId(snapshot.snapshotId()).sourceRegion(region).destinationRegion(region).kmsKeyId(kmsId).encrypted(true).copy().build();
                    CopySnapshotResponse copySnapshotResponse = ec2.copySnapshot(copySnapshotRequest);
                    TimeUnit.MINUTES.sleep(5);
                    DeleteSnapshotRequest deleteSnapshotRequest = DeleteSnapshotRequest.builder().snapshotId(snapshotId).build();
                    DeleteSnapshotResponse deleteSnapshotResponse = ec2.deleteSnapshot(deleteSnapshotRequest);
                }
                catch(InterruptedException e){
                    continue;
                }
            }
        }
    }

以上代码的问题在于，新加密的快照将状态设置为unavailable。

Answer 1

我在复制快照时删除了keyID，这样它就可以工作了。修改后的代码：

public static void encryptSnapshots(Ec2Client ec2, String snapshotId, String region, KmsClient kms){
        DescribeSnapshotsRequest describeSnapshotsRequest = DescribeSnapshotsRequest.builder().snapshotIds(snapshotId).build();
        DescribeSnapshotsResponse describeSnapshotsResponse = ec2.describeSnapshots(describeSnapshotsRequest);
        KeyUsageType keyUsageType = KeyUsageType.ENCRYPT_DECRYPT;
        CustomerMasterKeySpec customerMasterKeySpec = CustomerMasterKeySpec.SYMMETRIC_DEFAULT;
        OriginType originType = OriginType.AWS_KMS;
        CreateKeyRequest createKeyRequest = CreateKeyRequest.builder().keyUsage(keyUsageType).customerMasterKeySpec(customerMasterKeySpec).origin(originType).build();
        CreateKeyResponse createKeyResponse = kms.createKey(createKeyRequest);
        String kmsId = createKeyResponse.keyMetadata().keyId();
        for(Snapshot snapshot: describeSnapshotsResponse.snapshots()){
            if(!snapshot.encrypted()){
                try{
                    CopySnapshotRequest copySnapshotRequest = CopySnapshotRequest.builder().sourceSnapshotId(snapshot.snapshotId()).sourceRegion(region).destinationRegion(region).encrypted(true).copy().build();
                    CopySnapshotResponse copySnapshotResponse = ec2.copySnapshot(copySnapshotRequest);
                    TimeUnit.MINUTES.sleep(5);
                    DeleteSnapshotRequest deleteSnapshotRequest = DeleteSnapshotRequest.builder().snapshotId(snapshotId).build();
                    DeleteSnapshotResponse deleteSnapshotResponse = ec2.deleteSnapshot(deleteSnapshotRequest);
                }
                catch(InterruptedException e){
                    continue;
                }
            }
        }
    }