WorkSpaces user volumes should be encrypted at rest

How to fix it

• Replaces the resource: Encryption is set only at launch: copy the user's files off this WorkSpace and image it if you need its software, remove it, then create an encrypted one for the user and restore the files.
• Affects another check: Encrypt both volumes in the one launch, since a WorkSpace with only the user volume encrypted still fails WorkSpaces.2 and would need replacing again.
• Interrupts service: The user has no WorkSpace from its removal until the new one is available, which can take up to an hour with an encrypted root volume.

In the console

WorkSpaces → WorkSpaces, Personal → Create WorkSpaces → Customization → Encryption (fixed at launch)

Encryption

Root volume and user volume both selected

KMS key

aws/workspaces, or a symmetric customer managed key

Bundle

The flagged WorkSpace's bundle, or a custom bundle imaged from it to keep its software

User

The flagged WorkSpace's user, once that WorkSpace is removed

With the AWS CLI

aws workspaces create-workspaces --workspaces DirectoryId=<directory-id>,UserName=<user-name>,BundleId=<bundle-id>,VolumeEncryptionKey=<kms-key-arn>,UserVolumeEncryptionEnabled=true,RootVolumeEncryptionEnabled=true --region <region>

With Terraform

resource "aws_workspaces_workspace" "encrypted" {
  directory_id = var.directory_id
  bundle_id    = var.bundle_id
  user_name    = var.user_name

  root_volume_encryption_enabled = true
  user_volume_encryption_enabled = true
  volume_encryption_key          = var.kms_key_arn
}