Back to Checks
alibabacloud

ECS unattached disk is encrypted

ecs_unattached_disk_encrypted
Service: ecsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:ALIYUN::ECS::Disk

Alibaba Cloud ECS cloud disk encryption protects data at rest by automatically encrypting data when it is transferred from ECS instances to disks and decrypting it when read. This check verifies that unattached (detached) disks have encryption enabled, since unattached disks may still contain sensitive data from previous workloads and are especially vulnerable if not properly managed.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

Unencrypted unattached disks pose a significant security risk as they may contain sensitive data that could be accessed if the disk is compromised or accessed by unauthorized parties. Unattached disks are especially vulnerable as they may be overlooked in security monitoring, increasing the risk of unauthorized access and data breaches that impact confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks ecs_unattached_disk_encrypted

Recommendation

Ensure all unattached ECS disks are encrypted. Create new encrypted disks and migrate data from unencrypted disks, then delete the unencrypted originals.

Remediation

CLI

aliyun ecs CreateDisk --DiskName <disk_name> --Size <size> --Encrypted true --KmsKeyId <kms_key_id>

Terraform

resource "alicloud_ecs_disk" "encrypted" {
  zone_id   = "cn-hangzhou-a"
  disk_name = "encrypted-disk"
  category  = "cloud_efficiency"
  size      = 20
  encrypted = true
  kms_key_id = alicloud_kms_key.example.id
}

Other

1Log on to the **ECS Console**.
2In the left-side navigation pane, choose **Storage & Snapshots** > **Disk**.
3In the upper-right corner of the Disks page, click **Create Disk**.
4In the Disk section, check the **Disk Encryption** box and select a key from the drop-down list.
5*Note:** After a data disk is created, you can only encrypt it by manually copying data from the unencrypted disk to a new encrypted disk.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.ecs.ecs_client import ecs_client


class ecs_unattached_disk_encrypted(Check):
    """Check if unattached disks are encrypted."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for disk in ecs_client.disks:
            # Only check unattached disks
            if not disk.is_attached:
                report = CheckReportAlibabaCloud(
                    metadata=self.metadata(), resource=disk
                )
                report.region = disk.region
                report.resource_id = disk.id
                report.resource_arn = (
                    f"acs:ecs:{disk.region}:{ecs_client.audited_account}:disk/{disk.id}"
                )

                if disk.is_encrypted:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Unattached disk {disk.name if disk.name else disk.id} "
                        f"is encrypted."
                    )
                else:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Unattached disk {disk.name if disk.name else disk.id} "
                        f"is not encrypted."
                    )

                findings.append(report)

        return findings

References