---
names:
  full: "AWS WorkSpace instance EBS volumes are not encrypted"
  contextual: "WorkSpace instance EBS volumes are not encrypted"
description: >
  Ensure that Amazon WorkSpaces have both root and user storage volumes encrypted 
  at rest. Encrypting these volumes protects sensitive data stored on the virtual 
  desktop from unauthorized access and helps meet data-at-rest encryption requirements.
type: "COMPLIANCE_POLICY"
categories:
  - "SECURITY"
frameworkMappings:
  - "/frameworks/cloudaware/resource-security/data-encryption"
  - "/frameworks/aws-fsbp-v1.0.0/workspace/01"
  - "/frameworks/aws-fsbp-v1.0.0/workspace/02"
similarPolicies:
  awsSecurityHub:
    - name: "[WorkSpaces.1] WorkSpaces user volumes should be encrypted at rest"
      url: "https://docs.aws.amazon.com/securityhub/latest/userguide/workspaces-controls.html#workspaces-1"
    - name: "[WorkSpaces.2] WorkSpaces root volumes should be encrypted at rest"
      url: "https://docs.aws.amazon.com/securityhub/latest/userguide/workspaces-controls.html#workspaces-2"
  cloudConformity:
    - url: https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/WorkSpaces/storage-encryption.html
      name: WorkSpaces Storage Encryption