use block device mappings to know whether a snapshot existed before packer's current run. If yes, don't delete the unencrypted snapshot.

builder/amazon/chroot/builder.go

@@ -256,6 +256,7 @@ func (b *Builder) Run(ui packer.Ui, hook packer.Hook, cache packer.Cache) (packe
 			KeyID:             b.config.AMIKmsKeyId,
 			EncryptBootVolume: b.config.AMIEncryptBootVolume,
 			Name:              b.config.AMIName,
+			AMIMappings:       b.config.AMIBlockDevices.AMIMappings,
 		},
 		&awscommon.StepAMIRegionCopy{
 			AccessConfig:      &b.config.AccessConfig,

builder/amazon/common/step_encrypted_ami.go

@@ -15,6 +15,7 @@ type StepCreateEncryptedAMICopy struct {
 	KeyID             string
 	EncryptBootVolume bool
 	Name              string
+	AMIMappings       []BlockDevice
 }
 
 func (s *StepCreateEncryptedAMICopy) Run(state multistep.StateBag) multistep.StepAction {
@@ -118,7 +119,18 @@ func (s *StepCreateEncryptedAMICopy) Run(state multistep.StateBag) multistep.Ste
 
 	for _, blockDevice := range unencImage.BlockDeviceMappings {
 		if blockDevice.Ebs != nil && blockDevice.Ebs.SnapshotId != nil {
-			ui.Message(fmt.Sprintf("Snapshot ID: %s", *blockDevice.Ebs.SnapshotId))
+			// If this packer run didn't create it, then don't delete it
+			doDelete := true
+			for _, origDevice := range s.AMIMappings {
+				if origDevice.SnapshotId == *blockDevice.Ebs.SnapshotId {
+					doDelete = false
+				}
+			}
+			if doDelete == false {
+				ui.Message(fmt.Sprintf("Keeping Snapshot ID: %s", *blockDevice.Ebs.SnapshotId))
+				continue
+			}
+			ui.Message(fmt.Sprintf("Deleting Snapshot ID: %s", *blockDevice.Ebs.SnapshotId))
 			deleteSnapOpts := &ec2.DeleteSnapshotInput{
 				SnapshotId: aws.String(*blockDevice.Ebs.SnapshotId),
 			}

builder/amazon/ebs/builder.go

@@ -191,6 +191,7 @@ func (b *Builder) Run(ui packer.Ui, hook packer.Hook, cache packer.Cache) (packe
 			KeyID:             b.config.AMIKmsKeyId,
 			EncryptBootVolume: b.config.AMIEncryptBootVolume,
 			Name:              b.config.AMIName,
+			AMIMappings:       b.config.AMIBlockDevices.AMIMappings,
 		},
 		&awscommon.StepAMIRegionCopy{
 			AccessConfig:      &b.config.AccessConfig,