Back to Checks
alibabacloud

ECS attached disk is encrypted

ecs_attached_disk_encrypted
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::ECS::Disk

Alibaba Cloud ECS disk encryption protects data at rest by automatically encrypting data transferred to disks and decrypting when read. Ensuring all attached disks are encrypted prevents unauthorized access to stored data. This check verifies disk encryption is enabled on all ECS disks attached to instances, using KMS for key management.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Unencrypted disks attached to ECS instances pose a significant security risk, as sensitive data could be exposed if the disk is compromised, improperly decommissioned, or accessed by unauthorized parties. Data at rest without encryption is vulnerable to unauthorized access, impacting confidentiality and potentially leading to data breaches or regulatory non-compliance.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ecs_attached_disk_encrypted

Recommendation

Enable encryption on all ECS disks to protect data at rest. Use KMS-managed keys for encryption. Note that existing unencrypted disks cannot be directly converted; data must be migrated to new encrypted disks.

Remediation

CLI

aliyun ecs CreateDisk --DiskName <disk_name> --Size <size> --Encrypted true --KmsKeyId <kms_key_id>

Terraform

resource "alicloud_ecs_disk" "encrypted" {
  zone_id   = "cn-hangzhou-a"
  disk_name = "encrypted-disk"
  category  = "cloud_efficiency"
  size      = 20
  encrypted = true
  kms_key_id = alicloud_kms_key.example.id
}

Other

1Log on to the **ECS Console** > **Instances & Images** > **Images**.
2Select the **Custom Image** tab and select the target image.
3Click **Copy Image** and check the **Encrypt** box.
4Select a key and click **OK**.
5For data disks, go to **Instances** > **Create Instance**, in the Storage section click **Add Disk**, select **Disk Encryption**, and choose a key.
6*Note:** You cannot directly convert unencrypted disks to encrypted disks.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ecs.ecs_client import ecs_client


class ecs_attached_disk_encrypted(Check):
    """Check if attached disks are encrypted."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for disk in ecs_client.disks:
            # Only check attached disks
            if disk.is_attached:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=disk
                )
                report.region = disk.region
                report.resource_id = disk.id
                report.resource_arn = (
                    f"acs:ecs:{disk.region}:{ecs_client.audited_account}:disk/{disk.id}"
                )

                if disk.is_encrypted:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Disk {disk.name if disk.name else disk.id} attached to instance "
                        f"{disk.attached_instance_id} is encrypted."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Disk {disk.name if disk.name else disk.id} attached to instance "
                        f"{disk.attached_instance_id} is not encrypted."
                    )

                findings.append(report)

        return findings

References