使用 AWS 加密 EC2 快照 Java SDK

Question

我正在嘗試使用 AWS Java SDK 加密未加密的 EC2 快照。它是這樣工作的：

1. we need to copy the unencrypted EC2 snapshot because we can't make a change in already existing snapshot.
2. while copying, we need to set encryption as encrypted and create it.
3. After creating the encrypted snapshot, delete the unencrypted snapshot.

這就是我使用 AWS Java SDK 的方式：

 public static void encryptSnapshots(Ec2Client ec2, String snapshotId, String region, KmsClient kms){
        DescribeSnapshotsRequest describeSnapshotsRequest = DescribeSnapshotsRequest.builder().snapshotIds(snapshotId).build();
        DescribeSnapshotsResponse describeSnapshotsResponse = ec2.describeSnapshots(describeSnapshotsRequest);
        KeyUsageType keyUsageType = KeyUsageType.ENCRYPT_DECRYPT;
        CustomerMasterKeySpec customerMasterKeySpec = CustomerMasterKeySpec.SYMMETRIC_DEFAULT;
        OriginType originType = OriginType.AWS_KMS;
        CreateKeyRequest createKeyRequest = CreateKeyRequest.builder().keyUsage(keyUsageType).customerMasterKeySpec(customerMasterKeySpec).origin(originType).build();
        CreateKeyResponse createKeyResponse = kms.createKey(createKeyRequest);
        String kmsId = createKeyResponse.keyMetadata().keyId();
        for(Snapshot snapshot: describeSnapshotsResponse.snapshots()){
            if(!snapshot.encrypted()){
                try{
                    CopySnapshotRequest copySnapshotRequest = CopySnapshotRequest.builder().sourceSnapshotId(snapshot.snapshotId()).sourceRegion(region).destinationRegion(region).kmsKeyId(kmsId).encrypted(true).copy().build();
                    CopySnapshotResponse copySnapshotResponse = ec2.copySnapshot(copySnapshotRequest);
                    TimeUnit.MINUTES.sleep(5);
                    DeleteSnapshotRequest deleteSnapshotRequest = DeleteSnapshotRequest.builder().snapshotId(snapshotId).build();
                    DeleteSnapshotResponse deleteSnapshotResponse = ec2.deleteSnapshot(deleteSnapshotRequest);
                }
                catch(InterruptedException e){
                    continue;
                }
            }
        }
    }

上述代碼的問題是新加密的快照顯示狀態為unavailable

Answer 1

我在復制快照時刪除了 keyID，這樣它就可以工作了。 更改代碼：

public static void encryptSnapshots(Ec2Client ec2, String snapshotId, String region, KmsClient kms){
        DescribeSnapshotsRequest describeSnapshotsRequest = DescribeSnapshotsRequest.builder().snapshotIds(snapshotId).build();
        DescribeSnapshotsResponse describeSnapshotsResponse = ec2.describeSnapshots(describeSnapshotsRequest);
        KeyUsageType keyUsageType = KeyUsageType.ENCRYPT_DECRYPT;
        CustomerMasterKeySpec customerMasterKeySpec = CustomerMasterKeySpec.SYMMETRIC_DEFAULT;
        OriginType originType = OriginType.AWS_KMS;
        CreateKeyRequest createKeyRequest = CreateKeyRequest.builder().keyUsage(keyUsageType).customerMasterKeySpec(customerMasterKeySpec).origin(originType).build();
        CreateKeyResponse createKeyResponse = kms.createKey(createKeyRequest);
        String kmsId = createKeyResponse.keyMetadata().keyId();
        for(Snapshot snapshot: describeSnapshotsResponse.snapshots()){
            if(!snapshot.encrypted()){
                try{
                    CopySnapshotRequest copySnapshotRequest = CopySnapshotRequest.builder().sourceSnapshotId(snapshot.snapshotId()).sourceRegion(region).destinationRegion(region).encrypted(true).copy().build();
                    CopySnapshotResponse copySnapshotResponse = ec2.copySnapshot(copySnapshotRequest);
                    TimeUnit.MINUTES.sleep(5);
                    DeleteSnapshotRequest deleteSnapshotRequest = DeleteSnapshotRequest.builder().snapshotId(snapshotId).build();
                    DeleteSnapshotResponse deleteSnapshotResponse = ec2.deleteSnapshot(deleteSnapshotRequest);
                }
                catch(InterruptedException e){
                    continue;
                }
            }
        }
    }