AWS-EC2-EBS-Encryption-Enabled-By-Default

Severity : High

Description: This control ensures that encryption by default configuration for EBS volumes is enabled in account. The ‘encryption by default’ configuration enforce the encryption of the new EBS volumes and snapshot copies. Encryption operations occur on the servers that host EC2 instances, ensuring the security of both data-at-rest and data-in-transit between an instance and its attached EBS storage.

Remediation Steps:

Perform following to update default encryption for EBS :

1. Login to the AWS Management Console at https://console.aws.amazon.com.

2. Select the EC2 Service.

3. Navigate to EC2 Dashboard.

4. In the , choose Account Attributes, EBS encryption.

5. Choose Manage.

6. Check the Always encrypt new EBS volumes check box.

7. In the Default encryption key selection, enter a Customer KMS key created in KMS for EBS encryption. Optionally, a default key alias/aws/ebs  can also be used.

8. Click Update EBS encryption.

Important:

• Encryption by default has no effect on existing EBS volumes or snapshots.

• When encryption by default is enable, instance can launch only if the instance type supports EBS encryption.

Reference :

• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default