Although my overall objectives is to do something on Amazon Web Services (AWS), my specific question is agnostic to AWS.
Background
My objective is to use Packer to create an Amazon Machine Image (AMI) with several different paths mounted to different filesystems to improve security. E.g. /tmp should be mounted to a filesystem with the noexec option.
The fact that I want to create an automated process for making an AMI means that I can't execute re-mounting commands in the instance itself, so I am instead using the Packer amazon-chroot builder. This means I run an EC2 Instance, and run Packer from that EC2 Instance. Packer will then mount an EBS Volume taken from an EBS Snapshot used with a "source AMI". I now need to perform some operations on the mounted EBS Volume.
My Question
One of my first steps is to take a complete backup of of the block device mounted to /mnt/ebs.
According to the excellent presentation at this exact part https://youtu.be/8h_Y-L1Q8xI?t=13m47s, the speaker recommends doing this by first unmounting the device and then using tar.
He repeats this order of operations later in the presentation. My specific question is: how can I create a tar backup of the contents of a device if it's not mounted in the first place? Also, is the point of unmounting it first to guarantee that it's in a consistent state, that no further writes occur during backup, or something else?
As an aside, I can't seem to unmount the device without the umount -l option, despite checking for busy processes using fuser or lsof but I'll leave those details to another question.
Note that I am using Amazon Linux, which is similar to CentOS but doesn't use systemd.
