Windows – Encrypting mapped network drives in Windows

Is this in a domain environment? Why not use a login script to designate which driver letter to use and where to point it?

It looks like all Amazon is doing is storing the Bitlocker keys in DPAPI in the SYSTEM context. While this is much less secure than storing the keys in a TPM (because the plaintext key can be retrieved by any service running as SYSTEM versus a key stored in a TPM which cannot be recovered) if the TPM isn't exposed to the virtual machine this is probably your only option.

To accomplish something similar to what they're describing I'd probably use the ConvertFrom-SecureString and complimentary ConvertTo-SecureString PowerShell APIs. Per the Microsoft docs the ConvertFrom-SecureString cmdlet uses DPAPI if no static key is specified. Run the script in the SYSTEM context and DPAPI will encrypt your string w/ the machine account's password.

From that point it's a matter of using the manage-bde tool to unlock the drive using the retrieved password (e.g. manage-bde -unlock x: -password)