Check provider logo

EBS volume is encrypted

ec2_ebs_volume_encryption

Severityhigh
Serviceec2
by Prowler
encryption

EBS volumes are assessed for encryption at rest using AWS KMS.

The finding identifies volumes whose encrypted state is disabled, meaning data is stored unencrypted on block storage.

Risk

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Run this check with Prowler CLI

prowler aws --checks ec2_ebs_volume_encryption

Run in Prowler Cloud

Recommendation

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

Remediation

CLI

aws ec2 create-snapshot --volume-id <VOLUME_ID> --description "Snapshot for encryption" && aws ec2 copy-snapshot --source-region <REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description "Encrypted snapshot" && aws ec2 create-volume --snapshot-id <ENCRYPTED_SNAPSHOT_ID> --availability-zone <AZ> --encrypted

Native IaC
Terraform
Other
  1. In the AWS Console, go to EC2 > Volumes and select the unencrypted volume
  2. Choose Actions > Create snapshot and wait for it to complete
  3. Open the snapshot, click Actions > Create volume, select the same Availability Zone, and check Encrypted, then create
  4. Stop the instance using the old volume
  5. Detach the old (unencrypted) volume
  6. Attach the new encrypted volume to the instance using the same device name
  7. Start the instance
  8. Verify the new volume shows Encrypted = Yes

Source Code

Resource Type

AwsEc2Volume

References