EC2 launch templates should enable encryption for attached EBS volumes

How to fix it

Create a new launch template version with encryption set to true on every block device mapping that states a value, then make that version the default. A version cannot be edited, and stopping after the first step leaves instances launching from the old default. Only the default version is read, and only mappings that state an encryption value; the rest inherit the account-level setting, which is EC2.7.

In the console

EC2 → Launch templates → the template → Actions → Modify template (Create new version) → Storage (volumes) → Encrypted

With Terraform

resource "aws_launch_template" "this" {
  update_default_version = true
  block_device_mappings {
    device_name = "/dev/xvda"
    ebs {
      encrypted = "true"
    }
  }
}