The AMI is a complete image of the instance I am only looking for the EBS which is the image of the disk. The normal way to create a forensic image of an EBS volume is to use the tool aws_ir available on https://github.com/ThreatResponse/aws_ir - Brief instructions follow. You can also refer to the instructions on the GitHub page.
sudo pip install pluginbase
sudo pip install aws_ir
To verify, display the help with the following command: aws_ir -h
aws_ir uses ssh to collect the image and thus an ssh key is required.
Sample aws_ir command $ aws_ir --examiner-cidr-range '54.86.103.230/32' instance-compromise --target 54.152.212.162 --user ec2-user --ssh-key ~/.ssh/your-key-name.pem
I have attached more detailed instructions from SANS. It describes creating an instance in AWS and doing the analysis there. I prefer to just create an image and analyze it on our systems.
