Check provider logo

EBS default encryption is enabled

ec2_ebs_default_encryption

Severityhigh
Serviceec2
by Prowler
encryption

EBS uses encryption by default at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen KMS key

Risk

Without encryption by default, data on new EBS volumes and snapshots may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of confidentiality.

Run this check with Prowler CLI

prowler aws --checks ec2_ebs_default_encryption

Run in Prowler Cloud
Fix finding with Prowler CLI

prowler aws --checks ec2_ebs_default_encryption --fixer

Recommendation

Enable EBS encryption by default in every region and select a customer-managed KMS key. Apply least privilege to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as defense in depth.

Remediation

CLI

aws ec2 enable-ebs-encryption-by-default --region <REGION>

Native IaC
Terraform
Other
  1. In the AWS console, switch to the affected Region
  2. Go to EC2 > Settings (or Account attributes) > EBS encryption
  3. Click Enable default encryption and Save

Source Code

Resource Type

AwsEc2Volume

References