[JENKINS-75862] device mapping wrong encryption

cloud configured to an unencrypted ami as source for root device but Encrypt EBS root volume is set to be 'encrypted' , once instance is being launched looks like 2 api are beinh sent one is correct ( encrypted ) but the other is not encrypted 

The EC2 Plugin might inject a default (unencrypted) mapping

Even though you i set ebsEncryptRootVolume: ENCRYPTED, the plugin may still include an additional block device mapping based on the AMI's original snapshot (snap-*), and not override encryption on that explicitly.

"userData": "",

        "instanceType": "t3a.large",

        "blockDeviceMapping": {

            "items": [

                {

                    "deviceName": "/dev/xvda",

                    "ebs":

{
                        "snapshotId": "snap-0b7ea4cb7847ae4e7",
                        "volumeSize": 10,
                        "deleteOnTermination": true,
                        "volumeType": "gp3",
                        "iops": 3000,
                        "encrypted": true,
                        "throughput": 125
                    }

                },

                {

                    "deviceName": "/dev/xvda",

                    "ebs": {

                        "snapshotId": "snap-0b7ea4cb7847ae4e7",

                        "volumeSize": 10,

                        "deleteOnTermination": true,

                        "volumeType": "gp3",

                        "iops": 3000,

                        "encrypted": false,

                        "throughput": 125

 

---
Originally reported by yairm, imported from: device mapping wrong encryption

• assignee: thoulen
  
• status: Open
  
• priority: Major
  
• component(s): ec2-plugin
  
• label(s): plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-06
  

Raw content of original issue

cloud configured to an unencrypted ami as source for root device but Encrypt EBS root volume is set to be 'encrypted' , once instance is being launched looks like 2 api are beinh sent one is correct ( encrypted ) but the other is not encrypted 


The EC2 Plugin might inject a default (unencrypted) mapping


Even though you i set ebsEncryptRootVolume: ENCRYPTED, the plugin may still include an additional block device mapping based on the AMI's original snapshot (snap-*), and not override encryption on that explicitly.


"userData": "<sensitiveDataRemoved>",

        "instanceType": "t3a.large",

        "blockDeviceMapping": {

            "items": [

                {

                    "deviceName": "/dev/xvda",

                    "ebs": 

{

                        "snapshotId": "snap-0b7ea4cb7847ae4e7",

                        "volumeSize": 10,

                        "deleteOnTermination": true,

                        "volumeType": "gp3",

                        "iops": 3000,

                        "encrypted": true,

                        "throughput": 125

                    }

                },

                {

                    "deviceName": "/dev/xvda",

                    "ebs": {

                        "snapshotId": "snap-0b7ea4cb7847ae4e7",

                        "volumeSize": 10,

                        "deleteOnTermination": true,

                        "volumeType": "gp3",

                        "iops": 3000,

                        "encrypted": false,

                        "throughput": 125


 

environment

```
Jenkins version 2.504.1

ec2 1917.v6f3dd5711d3b_
```

Start by inspecting the EC2 plugin handling of `ebsEncryptRootVolume` and `blockDeviceMapping`, then reproduce the launch request using the configuration and AMI details shown. Compare the duplicate `/dev/xvda` entries and trace where the unencrypted mapping is added. Done means the launch request contains a single root-device mapping that honors encryption.

Written by the indexing model from the issue text.