在AWS Java SDK 1.10.69中,我可以启动一个实例并为该实例指定EBS卷映射:
RunInstancesRequest runInstancesRequest = new RunInstancesRequest();
String userDataString = Base64.encodeBase64String(userData.toString().getBytes());
runInstancesRequest
.withImageId(machineImageId)
.withInstanceType(instanceType.toString())
.withMinCount(minCount)
.withMaxCount(maxCount)
.withKeyName(sshKeyName)
.withSecurityGroupIds(securityGroupIds)
.withSubnetId(subnetId)
.withUserData(userDataString)
.setEbsOptimized(true);
final EbsBlockDevice ebsBlockDevice = new EbsBlockDevice();
ebsBlockDevice.setDeleteOnTermination(true);
ebsBlockDevice.setVolumeType(VolumeType.Gp2);
ebsBlockDevice.setVolumeSize(256);
ebsBlockDevice.setEncrypted(true);
final BlockDeviceMapping mapping = new BlockDeviceMapping();
mapping.setDeviceName("/dev/sdb");
mapping.setEbs(ebsBlockDevice);
看来目前我只能在该卷上启用/禁用加密,而不能指定要用于该卷的KMS客户主密钥。
有没有解决的办法?
最佳答案
编辑:请参阅下面的其他答案(https://stackoverflow.com/a/47602790/7692970),以获取现在更轻松的解决方案
要为实例的EBS卷指定客户主密钥(CMK),必须将RunInstancesRequest
与CreateVolumeRequest
和AttachVolumeRequest
组合在一起。否则,如果仅在true
上指定EbsBlockDevice
进行加密,它将使用默认的CMK。
首先创建实例,而不在RunInstancesRequest
的块设备映射中指定EBS卷,然后分别创建create the volumes和attach them。CreateVolumeRequest
具有withKmsKeyId()
/ setKmsKeyId()
选项。
例如,更新代码可能如下所示:
RunInstancesRequest runInstancesRequest = new RunInstancesRequest();
String userDataString = Base64.encodeBase64String(userData.toString().getBytes());
runInstancesRequest
.withImageId(machineImageId)
.withInstanceType(instanceType.toString())
.withMinCount(minCount)
.withMaxCount(maxCount)
.withKeyName(sshKeyName)
.withSecurityGroupIds(securityGroupIds)
.withSubnetId(subnetId)
.withUserData(userDataString)
.setEbsOptimized(true);
RunInstancesResult runInstancesResult = ec2Client.runInstances(runInstancesRequest);
for (Instance instance : runInstancesResult.getReservation()) {
CreateVolumeRequest volumeRequest = new CreateVolumeRequest()
.withAvailabilityZone(instance.getPlacement().getAvailabilityZone())
.withKmsKeyId(/* CMK id or alias/yourkeyaliashere */)
.withEncrypted(true)
.withSize(256)
.withVolumeType(VolumeType.Gp2);
CreateVolumeResult volumeResult = ec2Client.createVolume(volumeRequest);
AttachVolumeRequest attachRequest = new AttachVolumeRequest()
.withDevice("/dev/sdb")
.withInstanceId(instance.getInstanceId())
.withVolumeId(volumeResult.getVolume().getVolumeId());
ec2Client.attachVolume(attachRequest);
}
注意:如果您在实例元数据中使用块设备映射,则在将卷附加到正在运行的实例时不会更新它。要使其更新,您可以停止/启动实例。
关于java - AWS Java SDK:为EBS指定KMS key ID,我们在Stack Overflow上找到一个类似的问题:https://stackoverflow.com/questions/36696971/