EBS snapshot is encrypted

Check ID: ec2_ebs_snapshots_encrypted
Provider: AWS
Service: ec2
Severity: HIGH
Categories: encryption
Resource type: AwsEc2Volume

What this check verifies

EBS snapshots are evaluated for encryption at rest with AWS KMS. The finding identifies snapshots where encryption is not enabled.

Risk

Unencrypted snapshots expose complete disk images to anyone with snapshot access or if mis-shared. Attackers can exfiltrate data, harvest credentials, and clone volumes for offline analysis, compromising confidentiality and enabling lateral movement.

Recommendation

Encrypt all EBS snapshots and enable encryption by default to prevent unencrypted creations and copies. Use customer-managed KMS keys for control and rotation, restrict snapshot sharing, and enforce least privilege on snapshot and key permissions as defense in depth.

Remediation

CLI
Terraform
Dashboard steps

aws ec2 copy-snapshot —source-region <SOURCE_REGION> —source-snapshot-id <SNAPSHOT_ID> —encrypted —description “Encrypted copy of <SNAPSHOT_ID>”

resource "aws_ebs_snapshot_copy" "<example_resource_name>" {
  source_snapshot_id = "<UNENCRYPTED_SNAPSHOT_ID>"
  source_region      = "<SOURCE_REGION>"
  encrypted          = true  # Critical: creates an encrypted copy of the snapshot to remediate the finding
}

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_ebs_snapshots_encrypted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

All EBS snapshots have public access blocked EBS volume is encrypted

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires