EBS default encryption is enabled

Check ID: ec2_ebs_default_encryption
Provider: AWS
Service: ec2
Severity: HIGH
Categories: encryption
Resource type: AwsEc2Volume

What this check verifies

EBS uses encryption by default at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen KMS key

Risk

Without encryption by default, data on new EBS volumes and snapshots may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of confidentiality.

Recommendation

Enable EBS encryption by default in every region and select a customer-managed KMS key. Apply least privilege to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 enable-ebs-encryption-by-default —region <REGION>

resource "aws_ebs_encryption_by_default" "<example_resource_name>" {
  enabled = true  # Critical: enables default EBS encryption in this region
}

Resources:
  <example_resource_name>:
    Type: AWS::EC2::EBSEncryptionByDefault
    Properties:
      Enabled: true  # Critical: turns on default EBS encryption in this region

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_ebs_default_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires