Attached EBS volumes should be encrypted at-rest

How to fix it

• Replaces the resource: Encryption cannot be added to an existing volume: snapshot it, create an encrypted volume from the snapshot, attach that under the same device name, then delete this one.
• Interrupts service: Stop the instance before taking the snapshot and keep it stopped until the new volume is attached, or anything written in between is lost.

In the console

EC2 → Snapshots → a snapshot of this volume → Actions → Create volume from snapshot

Availability Zone

The instance's Availability Zone

Encryption

Encrypt this volume

KMS key

A customer managed key if its snapshots will be shared with another account; otherwise the default

With the AWS CLI

aws ec2 create-volume --availability-zone <availability-zone> --snapshot-id <snapshot-id> --encrypted --region <region>

With Terraform

• Can't be undone: In Terraform encrypted is create-only, so adding it to this volume's resource replaces the volume, with an empty one unless snapshot_id names its snapshot.

resource "aws_ebs_volume" "this" {
  availability_zone = var.availability_zone
  snapshot_id       = var.snapshot_id
  encrypted         = true
}