Boto3：EBS IAM需求的加密

Question

I am trying to create an EBS encrypted volume. If I keep encryption as False, it works as expected, when I turn it to True, a response with Http header 200 is returned, I get everything on my python console, but in reality the volume doesn't get created.

I think I lack IAM policies, what could be the required policies as I am not going to get IAM Full Access.

This is the response

{u'AvailabilityZone': 'ap-south-1a', 'ResponseMetadata': {'RetryAttempts': 0, 'HTTPStatusCode': 200, 'RequestId': '1c51475f-592c-4d78-bc31-242132b820ae', 'HTTPHeaders': {'transfer-encoding': 'chunked', 'vary': 'Accept-Encoding', 'server': 'AmazonEC2', 'content-type': 'text/xml;charset=UTF-8', 'date': 'Fri, 28 Apr 2017 07:09:38 GMT'}}, u'Encrypted': True, u'VolumeType': 'standard', u'VolumeId': 'vol-0fbbd415077636557', u'State': 'creating', u'SnapshotId': '', u'CreateTime': datetime.datetime(2017, 4, 28, 7, 9, 38, 612000, tzinfo=tzutc()), u'Size': 1}

If Encrypted=False, it works fine

Answer 1

You are most probably attempting to create an encrypted volume from an unencrypted snapshot.

The create_volume() documentation says:

Volumes that are created from encrypted snapshots are automatically encrypted. There is no way to create an encrypted volume from an unencrypted snapshot or vice versa.

Answer 2

Make sure the role or user (using which you are trying to make the create_volume() call) has the following set of permissions-

"kms:Decrypt", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:ListGrants", "kms:RevokeGrant", "kms:Encrypt", "kms:DescribeKey"

Since you are trying to encrypt the volumes you need to make sure your code is able to access the CMK that you intend to use.