Encrypted boot volume access in resource-on-demand environments

A method for executing booting process of a server instance on a resource providing device, comprising:

• receiving, by one or more processors, a request via a customer device to create (i) a server instance and (ii) a boot volume that is encrypted;
• identifying, by the one or more processors, a security token;
• associating the security token with metadata received with the request from the customer device, the security token being associated with an access key;
• publishing, by the one or more processors, the security token to an out-of-band location using an out-of-band communications channel, wherein the out-of-band location is accessible to the customer device to enable the customer device to access the security token from the out-of-band location and transit the security token to a key server;
• transmitting, by the one or more processors, a request for authentication to the key server using an in-band communications channel that is different from the out-of-band communications channel, wherein the request for authentication includes at least one of (i) the security token or (ii) information derived based on the security token, wherein the key server authenticates the server instance based at least in part on (i) receiving the request for authentication and (ii) receiving the security token that was published to the out-of-band location;
• upon successful authentication at the key server, receiving, by the one or more processors, the access key from the key server, wherein the security token and the access key are different;
• decrypting the encrypted boot volume using the access key;
• and
• booting from the boot volume that is decrypted.

A method for executing booting process of a server instance, the method comprising:

• transmitting, by a customer device, a request for creation of the server instance that is to boot from a boot volume, wherein the request for creation of the server instance is transmitted along with metadata associated with the server instance;
• specifying, by the customer device, a pre-defined instance image from which to create the server instance;
• obtaining, by the customer device, a security token from an out-of-band location, wherein the security token is published in the out-of-band location by the server instance using an out-of-band communications channel, wherein the security token is associated with the metadata;
• transmitting, by the customer device, the security token to a key server;
• and
• configuring, by the customer device, the server instance to perform actions comprising:
• transmitting a request to the key server for an access key using an in-band communications channel, wherein the in-band communications channel is different from the out-of-band communications channel, wherein the request to the key server includes at least one of (i) the security token or (ii) information derived based on the security token, and wherein the key server authenticates the server instance based at least in part on (i) receiving the request for the access key and (ii) receiving the security token that was stored in the out-of-band location by the server instance;
• based on the key server authenticating the server instance, receiving the access key from the key server, wherein the security token and the access key are different;
• decrypting the encrypted boot volume based at least on the access key;
• and
• executing a booting process of the service instance from the encrypted boot volume that has been decrypted.