migrate encrypted VM from Azure to AWS cloud

Question

Dear team.,

There is a requirement of Azure VM with Encrypted Disks (SSE+PMK and with ADE and keys are stored in Azure Key vault) which needs to be migrated from Azure to AWS.

For Migrating the Azure encrypted VM's to AWS using AWS SMS or AWS Cloud Endure does Azure VM first needs to be decrypted manually or will AWS Cloud Native Migration tool does the needful on its own while migration.

Answer 1

@Ankit Rathod
Thank you for your detailed post! When it comes to migrating encrypted disks, I'd recommend decrypting and creating a backup of your data prior to performing any type of migration.

SSE+PMK:
Since this is the default encryption method used in Azure, I'd recommend reaching out to AWS regarding whether or not their Cloud Native Migration tool can decrypt disks encrypted with SSE+PMK, since it's encrypted using 256-bit AES encryption.

With SSE+CMK, you won't be able to disable the encryption. You'll have to copy all the data using either Azure PowerShell, or Azure CLI, to an entirely different managed disk that isn't using customer-managed keys.

ADE:
You can disable/decrypt your disks using this PS script.

Disable-AzVMDiskEncryption -ResourceGroupName 'MyVirtualMachineResourceGroup' -VMName 'MySecureVM' -VolumeType "all"  

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

Hi JamesTran-MSFT,

Thanks for your quick response.

Your answer is helpful.