All checks
Medium
EBS default encryption should be enabled
Verifies that EBS encryption by default is on for the account in this Region, so every new EBS volume and snapshot copy is encrypted at rest with no change to launch templates or infrastructure code. Volumes that already exist are not affected.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Affects another check: This leaves EC2.3 failing on existing unencrypted volumes, and EC2.181 and EC2.173 on launch templates and Spot Fleet requests that set encryption off, until each is fixed.
In the console
EC2 → Settings → Data protection and security → EBS encryption → Manage
- Always encrypt new EBS volumes
- Enable
- Default encryption key
- aws/ebs, or a customer managed key if encrypted snapshots will be shared with another account
With the AWS CLI
aws ec2 enable-ebs-encryption-by-default --region <region>With Terraform
resource "aws_ebs_encryption_by_default" "this" {
enabled = true
}See which of your accounts this check is failing on.
Book a live scan