Back to Checks
aws

EBS default encryption is enabled

ec2_ebs_default_encryption
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsEc2Volume

EBS uses encryption by default at the account and region level, ensuring new volumes, snapshots, and AMI-backed volumes are automatically encrypted with a chosen KMS key

Prowler logoProwlerprowler-provider-aws

Risk

Without encryption by default, data on new EBS volumes and snapshots may be stored in plaintext. A compromised account or mis-shared snapshot can expose disk contents, enabling data exfiltration, offline analysis, and loss of confidentiality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ebs_default_encryption

Recommendation

Enable EBS encryption by default in every region and select a customer-managed KMS key. Apply least privilege to key use, rotate keys, and monitor access. Enforce encrypted volume creation with organizational guardrails and secure templates as defense in depth.

Remediation

CLI

aws ec2 enable-ebs-encryption-by-default --region <REGION>

Terraform

resource "aws_ebs_encryption_by_default" "<example_resource_name>" {
  enabled = true  # Critical: enables default EBS encryption in this region
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::EC2::EBSEncryptionByDefault
    Properties:
      Enabled: true  # Critical: turns on default EBS encryption in this region

Other

1In the AWS console, switch to the affected Region
2Go to EC2 > Settings (or Account attributes) > EBS encryption
3Click Enable default encryption and Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ebs_default_encryption(Check):
    def execute(self):
        findings = []
        for ebs_encryption in ec2_client.ebs_encryption_by_default:
            if ebs_encryption.volumes or ec2_client.provider.scan_unused_services:
                report = Check_Report_AWS(
                    metadata=self.metadata(), resource=ebs_encryption
                )
                report.resource_arn = ec2_client._get_volume_arn_template(
                    ebs_encryption.region
                )
                report.resource_id = ec2_client.audited_account
                report.status = "FAIL"
                report.status_extended = "EBS Default Encryption is not activated."
                if ebs_encryption.status:
                    report.status = "PASS"
                    report.status_extended = "EBS Default Encryption is activated."
                findings.append(report)

        return findings

References