Check ID: workspaces_volume_encryption_enabled
Provider: AWS
Service: workspaces
Severity: HIGH
Categories: encryption
Resource type: AwsEc2Volume

​
What this check verifies

Amazon WorkSpaces evaluates encryption at rest on each workspace’s EBS volumes. It checks whether the root and user volumes are encrypted with a KMS key and identifies workspaces where either volume is unencrypted.

​
Risk

Unencrypted volumes allow offline access to files, cached credentials, and profile data from snapshots or underlying storage, harming confidentiality. Storage-level access can enable data tampering, impacting integrity, and facilitate token reuse for lateral movement.

​
Recommendation

Enable KMS-backed encryption for both root and user volumes on all WorkSpaces. Prefer customer-managed keys, enforce least privilege on key use, and enable rotation. Embed encryption into provisioning templates and policies to block unencrypted launches. Keep required keys enabled for rebuilds and restores.

​
Remediation

# Terraform: create a WorkSpace with both volumes encrypted
resource "aws_workspaces_workspace" "example" {
  bundle_id    = "<example_bundle_id>"
  directory_id = "<example_directory_id>"
  user_name    = "<example_user_name>"

  root_volume_encryption_enabled = true  # Critical: encrypts the root volume
  user_volume_encryption_enabled = true  # Critical: encrypts the user volume
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = workspaces_volume_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks