Back to Checks
aws

EBS snapshot is encrypted

ec2_ebs_snapshots_encrypted
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsEc2Volume

EBS snapshots are evaluated for encryption at rest with AWS KMS. The finding identifies snapshots where encryption is not enabled.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted snapshots expose complete disk images to anyone with snapshot access or if mis-shared. Attackers can exfiltrate data, harvest credentials, and clone volumes for offline analysis, compromising confidentiality and enabling lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ebs_snapshots_encrypted

Recommendation

Encrypt all EBS snapshots and enable encryption by default to prevent unencrypted creations and copies. Use customer-managed KMS keys for control and rotation, restrict snapshot sharing, and enforce least privilege on snapshot and key permissions as defense in depth.

Remediation

CLI

aws ec2 copy-snapshot --source-region <SOURCE_REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description "Encrypted copy of <SNAPSHOT_ID>"

Terraform

resource "aws_ebs_snapshot_copy" "<example_resource_name>" {
  source_snapshot_id = "<UNENCRYPTED_SNAPSHOT_ID>"
  source_region      = "<SOURCE_REGION>"
  encrypted          = true  # Critical: creates an encrypted copy of the snapshot to remediate the finding
}

Other

1In the AWS Console, go to EC2 > Snapshots and select the unencrypted snapshot
2Click Actions > Copy snapshot
3Check Encrypt this snapshot (leave the default KMS key unless a specific key is required)
4Click Copy snapshot and wait for the new encrypted snapshot to be available
5Select the original unencrypted snapshot > Actions > Delete snapshot > Delete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ebs_snapshots_encrypted(Check):
    def execute(self):
        findings = []
        for snapshot in ec2_client.snapshots:
            report = Check_Report_AWS(metadata=self.metadata(), resource=snapshot)
            report.status = "PASS"
            report.status_extended = f"EBS Snapshot {snapshot.id} is encrypted."
            if not snapshot.encrypted:
                report.status = "FAIL"
                report.status_extended = f"EBS Snapshot {snapshot.id} is unencrypted."
            findings.append(report)

        return findings

References