These will be attached when launching your instance. Your options here may vary depending on the type of VM you use. Example use case: The following mapping will tell Packer to encrypt the root volume of the build instance at launch using a specific non-default kms key: JSON example: ```json launch_block_device_mappings: [ { "device_name": "/dev/sda1", "encrypted": true, "kms_key_id": "1a2b3c4d-5e6f-1a2b-3c4d-5e6f1a2b3c4d" } ] ``` HCL2 example: ```hcl launch_block_device_mappings { device_name = "/dev/sda1" encrypted = true kms_key_id = "1a2b3c4d-5e6f-1a2b-3c4d-5e6f1a2b3c4d" } ``` Please note that the kms_key_id option in this example exists for launch_block_device_mappings but not ami_block_device_mappings. Documentation for Block Devices Mappings can be found here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html