Skip to main content

🛡️ AWS EBS Attached Volume is not encrypted🟢

Stats​

not available

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-5590c1d51

Description​

Open File

Description​

Ensure that all attached AWS EBS volumes are encrypted at rest using AWS-managed or customer-managed keys. Encryption provides a critical layer of data protection and should be enforced for all in-use volumes.

Rationale​

Encrypting EBS volumes at rest helps safeguard sensitive data from unauthorized access in the event of physical compromise or internal misuse. Enforcing encryption for all attached volumes ensures that data is protected during operation and aligns with security best practices and compliance requirements.

Audit​

This policy flags an AWS EBS Volume as INCOMPLIANT if the Encrypted checkbox is set to false and the Volume is currently attached to an EC2 instance.

Volumes that are not attached to any instance are marked as INAPPLICABLE.

Remediation​

Open File

Remediation​

AWS EBS does not support in-place encryption of existing unencrypted volumes. To encrypt an unencrypted volume, you must create a snapshot of the volume and then use that snapshot to create a new encrypted volume.

Optionally, you can enable encryption by default to ensure that all future EBS volumes are automatically encrypted, including those created from unencrypted snapshots.

From Command Line​

Enable Default Encryption​

This ensures that all new volumes created in the specified region are encrypted by default:

aws ec2 enable-ebs-encryption-by-default --region {{region}}
Create a Snapshot of the Unencrypted Volume​
aws ec2 create-snapshot \
    --volume-id {{volume-id}} \
    --description "{{Snapshot description}}"

Wait until the snapshot status is completed before proceeding.

Create a New Encrypted Volume from the Snapshot​
aws ec2 create-volume \
    --snapshot-id {{snapshot-id}} \
    --availability-zone {{availability-zone}} \
    --encrypted

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 52c appropriate encryption, cleansing and auditing of devices;1313no data
💼 APRA CPG 234 → 💼 54 Cryptographic techniques can be used to control access to sensitive data, both in storage and in transit. The strength of the cryptographic techniques deployed would be commensurate with the sensitivity and criticality of the data as well as other supplementary or compensating controls (refer to Attachment E for further guidance).2526no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [EC2.3] Attached Amazon EBS volumes should be encrypted at-rest13no data
💼 AWS Well-Architected → 💼 SEC08-BP02 Enforce encryption at rest20no data
💼 Cloudaware Framework → 💼 Data Encryption65no data
💼 FedRAMP High Security Controls → 💼 AC-4(4) Flow Control of Encrypted Information (H)3031no data
💼 FedRAMP High Security Controls → 💼 CM-3(6) Cryptography Management (H)17no data
💼 FedRAMP High Security Controls → 💼 SC-7(10) Prevent Exfiltration (H)18no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1844no data
💼 FedRAMP High Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)1838no data
💼 FedRAMP High Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)626no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)44no data
💼 FedRAMP Low Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)138no data
💼 FedRAMP Low Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)26no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)44no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28 Protection of Information at Rest (L)(M)(H)138no data
💼 FedRAMP Moderate Security Controls → 💼 SC-28(1) Cryptographic Protection (L)(M)(H)26no data
💼 GDPR → 💼 Art. 25 Data protection by design and by default1413no data
💼 GDPR → 💼 Art. 32 Security of processing1010no data
💼 HIPAA Security Rules → 💼 164.312(a)(2)(iv) Encryption and Decryption (A)22no data
💼 ISO/IEC 27001:2013 → 💼 A.10.1.1 Policy on the use of cryptographic controls2122no data
💼 NIST CSF v1.1 → 💼 PR.DS-1: Data-at-rest is protected1631no data
💼 NIST CSF v1.1 → 💼 PR.DS-5: Protections against data leaks are implemented89152no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected248no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected219no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected249no data
💼 NIST SP 800-53 Revision 4 → 💼 CM-3 (6) CRYPTOGRAPHY MANAGEMENT22no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4(2) Information Flow Enforcement _ Processing Domains3638no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks54no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3(6) Configuration Change Control _ Cryptography Management17no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(10) Boundary Protection _ Prevent Exfiltration18no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection432no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28 Protection of Information at Rest32039no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-28(1) Protection of Information at Rest _ Cryptographic Protection1126no data
💼 NIST SP 800-53 Revision 5 → 💼 SI-7(6) Software, Firmware, and Information Integrity _ Cryptographic Protection27no data
💼 PCI DSS v3.2.1 → 💼 3.4.1 If disk encryption is used, logical access must be managed separately and independently of native operating system authentication and access control mechanisms.813no data
💼 PCI DSS v4.0.1 → 💼 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.15no data
💼 PCI DSS v4.0.1 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.13no data
💼 PCI DSS v4.0 → 💼 3.3.2 SAD that is stored electronically prior to completion of authorization is encrypted using strong cryptography.1015no data
💼 PCI DSS v4.0 → 💼 3.5.1.3 If disk-level or partition-level encryption is used (rather than file-, column-, or field--level database encryption) to render PAN unreadable.13no data
💼 SOC 2 → 💼 CC6.1-10 Uses Encryption to Protect Data712no data