EC2 Spot Fleet requests with launch parameters should enable encryption for attached EBS volumes

How to fix it

• Replaces the resource: Launch parameters cannot be modified: submit a new request with encryption on, wait for it to reach capacity, then cancel this one and terminate its instances.
• Affects another check: Turning on EBS encryption by default (EC2.7) does not clear this finding: the check reads the value the request states, and a stated false keeps failing.

In the console

EC2 → Spot Requests → Create Spot Fleet Request → Manually configure launch parameters → Additional launch parameters

Encrypted

On, for every EBS volume the request defines

With Terraform

resource "aws_spot_fleet_request" "this" {
  iam_fleet_role  = var.fleet_role_arn
  target_capacity = 2
  launch_specification {
    ami           = var.ami_id
    instance_type = "m5.large"
    root_block_device {
      encrypted = true
    }
  }
}