migrate encrypted VM from Azure to AWS cloud

Ankit Rathod 371 Reputation points

Dear team.,

There is a requirement of Azure VM with Encrypted Disks (SSE+PMK and with ADE and keys are stored in Azure Key vault) which needs to be migrated from Azure to AWS.

For Migrating the Azure encrypted VM's to AWS using AWS SMS or AWS Cloud Endure does Azure VM first needs to be decrypted manually or will AWS Cloud Native Migration tool does the needful on its own while migration.

Azure Key Vault
Azure Key Vault
An Azure service that is used to manage and protect cryptographic keys and other secrets used by cloud apps and services.
1,163 questions
Azure Disk Encryption
Azure Disk Encryption
An Azure service for virtual machines (VMs) that helps address organizational security and compliance requirements by encrypting the VM boot and data disks with keys and policies that are controlled in Azure Key Vault.
162 questions
0 comments No comments
{count} votes

Accepted answer
  1. JamesTran-MSFT 36,496 Reputation points Microsoft Employee

    @Ankit Rathod
    Thank you for your detailed post! When it comes to migrating encrypted disks, I'd recommend decrypting and creating a backup of your data prior to performing any type of migration.

    Since this is the default encryption method used in Azure, I'd recommend reaching out to AWS regarding whether or not their Cloud Native Migration tool can decrypt disks encrypted with SSE+PMK, since it's encrypted using 256-bit AES encryption.

    With SSE+CMK, you won't be able to disable the encryption. You'll have to copy all the data using either Azure PowerShell, or Azure CLI, to an entirely different managed disk that isn't using customer-managed keys.

    You can disable/decrypt your disks using this PS script.

    Disable-AzVMDiskEncryption -ResourceGroupName 'MyVirtualMachineResourceGroup' -VMName 'MySecureVM' -VolumeType "all"  

    If you have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.


    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

    0 comments No comments

1 additional answer

Sort by: Most helpful
  1. Ankit Rathod 371 Reputation points

    Hi JamesTran-MSFT,

    Thanks for your quick response.

    Your answer is helpful.

    0 comments No comments