Create an EC2 instance with an encrypted EBS volume

Short answer

Use amazon.aws to create an EC2 instance that attaches an encrypted EBS root volume.

Request

create an ec2 instance with an encrypted ebs volume

Example

A quick heads-up: Every environment is different. Review and test this example before you run it on systems you care about.

---
- name: Create EC2 instance with encrypted EBS
  hosts: localhost
  gather_facts: false
  connection: local

  tasks:
    - name: Launch instance
      amazon.aws.ec2_instance:
        name: "aim-encrypted-example"
        region: us-east-1
        image_id: ami-0c101f26f147fa7fd
        instance_type: t3.micro
        wait: true
        volumes:
          - device_name: /dev/xvda
            ebs:
              volume_size: 20
              volume_type: gp3
              encrypted: true
              delete_on_termination: true
      register: ec2

How it works

Set encrypted to true on the EBS volume definition. Provide a valid AMI, region, and credentials before you run the playbook.

When to use it

• Meeting encryption requirements for new instances
• Standardizing encrypted root volumes in automation

Requirements

• Collection: amazon.aws
• Technology: Amazon EC2
• AWS credentials available to ansible
• Permission to run ec2:RunInstances

Validation

• Syntax validated
• Not execution-tested
• Last verified 2026-09-03