The data to be contained in the shared snapshot

volume should be created. The data to be contained in the shared snapshot should be copied to the new volume, and
the snapshot created from the new volume.
Amazon EBS volumes are presented to the customer as raw unformatted block devices, which have been wiped prior to
being made available for use. Customers that have procedures requiring that all data be wiped via a specific method,
such as those detailed in DoD 5220.22-M (“National Industrial Security Program Operating Manual “) or NIST 800-88
(“Guidelines for Media Sanitization”), have the ability to do so on Amazon EBS. Customers should conduct a specialized
wipe procedure prior to deleting the volume for compliance with their established requirements. Encryption of sensitive
data is generally a good security practice, and AWS encourages users to encrypt their sensitive data via an algorithm
consistent with their stated security policy.
Amazon Virtual Private Cloud (Amazon VPC) Security
Security within Amazon Virtual Private Cloud begins with the very concept of a VPC and extends to include the security
groups, network access control lists (ACLs), routing, and external gateways. Each of these items is complementary to
providing a secure, isolated network that can be extended through selective enabling of direct Internet access or private
connectivity to another network. Below we describe the multiple levels of security in Amazon VPC. This is followed by a
diagram depicting how the Amazon VPC components relate.
Multiple Levels of Security
Virtual Private Cloud: Each VPC is a distinct, isolated network within the cloud. At creation time, an IP address range for
each VPC is selected by the customer. Network traffic within each VPC is isolated from all other VPCs; therefore,
multiple VPCs may use overlapping (even identical) IP address ranges without loss of this isolation. By default, VPCs have
no external connectivity. Customers may create and attach an Internet Gateway, VPN Gateway, or both to establish
external connectivity, subject to the controls below.
API : Calls to create and delete VPCs, change routing, security group, and network ACL parameters, and perform other
functions are all signed by the customer’s Amazon Secret Access Key, which could be either the AWS Accounts Secret
Access Key or the Secret Access key of a user created with AWS IAM. Without access to the customer’s Secret Access
Key, Amazon VPC API calls cannot be made on the customer’s behalf. In addition, API calls can be encrypted with SSL to
maintain confidentiality. Amazon recommends always using SSL-protected API endpoints. AWS IAM also enables a
customer to further control what APIs a newly created user has permissions to call.
Subnets: Customers create one or more subnets within each VPC; each instance launched in the VPC is connected to
one subnet. Traditional Layer 2 security attacks, including MAC spoofing and ARP spoofing, are blocked.