I'm ready for them rebias fun.
So let's do it.
You have an encrypted snapshot that was shared with you from another account encrypted snapshot shared
with you from another account.
You want to use this snapshot.
So the shared encrypted snapshot to create a new obvious volume under your account would you.
The below statement is that right.
Is that right.
It's not is not the right or it's wrong or it's not relevant.
It is the right next step.
You must do what is the step that you must do next before you can create as volumes from the shared
snapshot.
There's a snapshot is shared with your account and it is encrypted.
So what's the next step that you can do in order after that step to be able to create it as volumes
under your account.
They create an ABS volume from the shares not shot directly or immediately be stored the same Kiki's
used to encrypt the original snapshot for future encryption.
See an encrypted snapshot then create the volume from the unencrypted snapshot.
The first you must create a copy of the shared snapshot.
Then you can create the ABS volume from the copy.
Important information shared encrypted snapshot from another account.
You want to create an obvious volume and it is a single choice.
OK so let's look at the choices analysis a.
So what are we trying to do.
We have a shared encrypted snapshot and we want to make Amoebe as volume of that snapshot in the new
account.
So the new account owner needs to do that couldn't be as volume from the shared snapshot directly wrong.
That is not the next step.
What is the next step you must do.
Store the CME Kiki's used during a snapshot for future encryption.
And encrypt the snapshot then create the volume from the encrypted snapshot is wrong.
Because I'm here.
Why am I saying wrong and right.
Because there is there are steps to do that and none of these is the next step.
The and here is the right one you must create first ones it is sheared an encrypted snapshot were in
your account with your account.
Then you must create a copy of the shared snapshot in your account.
Then you can create volumes from the copy that you just made that these are the steps.
OK.
So it is incorrect because you must first create your own copy B is incorrect because you only have
access to the encryption keys does not mean you own them.
C is incorrect because you do not have to unencrypted first and the is the correct one refresher.
You must first create a copy of the shared snap shot from other accounts from a shared encrypted before
you can use it to create restore as Williams.
You can choose to encrypt during the copy process using one of UCM Kiki to have full control over it.
Why would you do that.
Remember when we talked about the Keys we said that when you are about to create the first encrypted
snapshot of your abs volume what happens it will create for you exactly that default.
See Kiki's.
And that key will be used to create exactly the first snapshot or the first copy created.
So this one is created with the same key.
Now if you want to create Eby as volumes of snapshot snapshots created from an encrypted volume of encrypted
volumes created from an encrypted snapshot are also encrypted.
So how can that be as volume that you're creating from the snapshot be encrypted using the same key.
So the same key gets used all the way.
Now let's look at the one that was shared with you so the one that was shared with you was encrypted.
Right.
The snapshot was encrypted so it was created from an encrypted volume.
Right.
And it was encrypted was another the phone system cakey How do I know.
Because the snapshot for that to cross account boundaries for either of us to allow to be shared from
one account to another.
It must not be encrypted using the default TMK cakey of the original or the sharing account.
So it is not it's done on the phone.
Kicky that's not so just created an encrypted using these key and there's snapchat when it is shared
with you.
Now it does.
It has cost account a to account b your account.
So that's natural that you have here.
Why did we dictate as part of the process that they should give you access to that non-default TMK cakey
for the snapshot.
Because there is no way you can do anything on the snapshot unless if you have access or permissions
on the key that was used to encrypt the snapshot or originally to encrypt the original abs volume that
created the snapshot.
Now it is highly recommended by either of us.
Because now I can't it gives you that permission.
What if it can't revoke the permission before you do anything with a snapchat.
Or maybe you did not do anything you would just create a copy under your account of the snapshot and
you use this copy to create business volumes in your account.
Now what's happening.
How did you copy the encrypted one because you had access to the key.
How did you create an Eby s volume of that copy of that encrypted snapshot copy.
Because again the volume would be encrypted using the same key.
So are you noticing something here that account is key.
You are totally dependent on that key and your access privileges that are granted to you temporarily
could be temporarily account you can revoke access whenever they want.
So anything you are creating if I created a snapshot of these CBS volume that I created again in the
same key.
So all of these are dependent on a key that you don't own.
That's what the U.S. is always recommending.
If you have an encrypted snapshot shared with you from another account the very first thing you do is
when you are creating the copy that he encrypted with an different key that you own.
Why.
Because it means this one will be key to not key one anymore.
If it is with K-2 that means that eBay has volume will also be encrypted using key to and you own K-2
and that's natural that you will create this volume will be also encrypted using K-2.
So you have full control over the copies and volumes and the snapshots encryption if you lose if you
lose no account is key.
You don't care k because that will only affect the original snapshot that was shared with you which
you don't need it anymore because you created a copy encrypted encrypted with your your key created
as volumes and snapshots.
So now whatever data was shared with you is under your full control.
All right.
Yes account a shared an encrypted snapshot with us.
It can be the owner of freedom because it can be created a copy of the shared snapshot then created
an enormous volume of that copy and remember there is no free encryption anywhere during the copy process
that was mentioned.
So there is no just copy it.
Copy that and create it as well.
Later the owner of a count a vote either as account BS writes on the CMD key encryption key of the originally
shared snapshot.
So if this snapshot that was shared was done with the one account be used shared encrypt a snapshot
that was encrypted with key one to create a copy and then created the first volume of that copy.
So all that is dependent on exactly K-1.
So now our county has revoked your access or it can be access to the key of those shared snapshots.
Would this account be access to the created as volume of of the sheer snapshot copy be impacted.
Is there going to be any impact on the encrypted data when I can BS newly created volume off of that
snapshot because of that evocation of the key the access permissions on the key.
Yes or no and wide.
So ACS known since that copy is already created and the volume is under the new account control wrong.
No access.
So no it's not impacted the access to the shared snapchat will be impacted but not to the volume created.
Wrong.
Yes.
That UBS volume data will be an encrypted since Exeter's Kiki used to encrypt the shared snapshot is
lost wrong losing an access permissions to a key does not mean the encrypted data gets decrypted or
encrypted the.
Yes that is volume access will be denied since the permissions over the CM key key used to encrypt the
shared snapshot is now revoked which is still the key used to encrypt the created as well.
The correct answer.
So the important information a copy of this year's snapshot was copied without changing the encryption
key so it remained encrypted with the account a custom key as volume was created from the copy of the
shared snapshot still with the original key.
So the volume remained encrypted with the account is custom CMD Kiki it is account means access to the
custom TMK key used to encrypt the snapshot was revoked and it's a single choice.
So now we understand the correct answer is D.
And a quick refresher.
So important information when you have an encrypted snapshot shared with you from another account and
you are granted access permissions to the key you are highly recommended to do what the encrypted when
you are doing the copy process using a key of your own.
This will protect your access to the snapshot and the created volume's in if in case that the key used
to encrypt the original shared snapshot is compromised.
Or if you lose your rights on that key.
All right.
So again a break and we come back to more fun.
I'll see in the next lecture.