These will be attached when launching your instance. Your options here may vary depending on the type of VM you use. Example use case: The following mapping will tell Packer to encrypt the root volume of the build instance at launch using a specific non-default kms key: HCL2 example: ```hcl launch_block_device_mappings { device_name = "/dev/sda1" encrypted = true kms_key_id = "1a2b3c4d-5e6f-1a2b-3c4d-5e6f1a2b3c4d" } ``` JSON example: ```json "launch_block_device_mappings": [ { "device_name": "/dev/sda1", "encrypted": true, "kms_key_id": "1a2b3c4d-5e6f-1a2b-3c4d-5e6f1a2b3c4d" } ] ``` Please note that the kms_key_id option in this example exists for launch_block_device_mappings but not ami_block_device_mappings. Documentation for Block Devices Mappings can be found here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html