EBS volume is encrypted

Check ID: ec2_ebs_volume_encryption
Provider: AWS
Service: ec2
Severity: HIGH
Categories: encryption
Resource type: AwsEc2Volume

What this check verifies

EBS volumes are assessed for encryption at rest using AWS KMS. The finding identifies volumes whose encrypted state is disabled, meaning data is stored unencrypted on block storage.

Risk

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality. Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Recommendation

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies. Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 create-snapshot —volume-id <VOLUME_ID> —description “Snapshot for encryption” && aws ec2 copy-snapshot —source-region <REGION> —source-snapshot-id <SNAPSHOT_ID> —encrypted —description “Encrypted snapshot” && aws ec2 create-volume —snapshot-id <ENCRYPTED_SNAPSHOT_ID> —availability-zone <AZ> —encrypted

# Encrypted EBS volume
resource "aws_ebs_volume" "<example_resource_name>" {
  availability_zone = "<example_az>"
  size              = 1
  encrypted         = true  # CRITICAL: ensures the volume is created encrypted
}

# CloudFormation: Encrypted EBS volume
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Volume
    Properties:
      AvailabilityZone: <example_az>
      Size: 1
      Encrypted: true  # CRITICAL: enables EBS encryption so the volume is created encrypted

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_ebs_volume_encryption. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires