Encrypting Root and Swap Drives on AWS

If the Linux installation does not have a separate boot partition, you must set up a new disk device. This document describes how to prepare a separate boot device on Linux VMs in Amazon Web Services (AWS).

Create and add another device from EBS to the existing instance. For example, say the current Linux is installed on device /dev/sda1 and the GRUB stage1 is also installed on /dev/sda1. This is a typical Linux installation. Find out the space required by the /boot subtree:

# du -sh /boot

The new boot partition should at least have two times this space. As a rule of thumb, the space provided should be twice the space used by /boot, plus 100MB. Assuming that you add a new device named /dev/xvdf, run the script aws-prepare-boot.sh, which is installed as part of the HyTrust client agent package.

# /opt/hcs/bin/aws-prepare-boot.sh /dev/xvdf

Power OFF the AWS instance.

Now, from the EC2 console, detach the original volume and new volume from the VM instance. Then attach back both the devices but with names exchanged. So the new volume should be added as /dev/sda1 and the original volume should be added as /dev/sdf. This changes the boot device for the VM instance.

Note the use of /dev/sda1 and not /dev/sda, as the EC2 console typically uses this name for the OS disk, i.e. the boot disk

Your system is ready now.