Back to Checks
aws

EBS volume is encrypted

ec2_ebs_volume_encryption
Service: ec2Severity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsEc2Volume

EBS volumes are assessed for encryption at rest using AWS KMS.

The finding identifies volumes whose encrypted state is disabled, meaning data is stored unencrypted on block storage.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted volumes or snapshots can be copied, shared, or recovered and reveal raw data, undermining confidentiality.

Adversaries with host or account access can read disks offline, harvest secrets, or alter system images, affecting integrity and enabling lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_ebs_volume_encryption

Recommendation

Encrypt all EBS volumes and enable encryption by default for new volumes and snapshot copies.

Apply least privilege to KMS keys, restrict snapshot sharing, and enforce defense in depth with policies and templates that prevent creation of unencrypted storage.

Remediation

CLI

aws ec2 create-snapshot --volume-id <VOLUME_ID> --description "Snapshot for encryption" && aws ec2 copy-snapshot --source-region <REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --description "Encrypted snapshot" && aws ec2 create-volume --snapshot-id <ENCRYPTED_SNAPSHOT_ID> --availability-zone <AZ> --encrypted

Terraform

# Encrypted EBS volume
resource "aws_ebs_volume" "<example_resource_name>" {
  availability_zone = "<example_az>"
  size              = 1
  encrypted         = true  # CRITICAL: ensures the volume is created encrypted
}

NativeIaC

# CloudFormation: Encrypted EBS volume
Resources:
  <example_resource_name>:
    Type: AWS::EC2::Volume
    Properties:
      AvailabilityZone: <example_az>
      Size: 1
      Encrypted: true  # CRITICAL: enables EBS encryption so the volume is created encrypted

Other

1In the AWS Console, go to EC2 > Volumes and select the unencrypted volume
2Choose Actions > Create snapshot and wait for it to complete
3Open the snapshot, click Actions > Create volume, select the same Availability Zone, and check Encrypted, then create
4Stop the instance using the old volume
5Detach the old (unencrypted) volume
6Attach the new encrypted volume to the instance using the same device name
7Start the instance
8Verify the new volume shows Encrypted = Yes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_ebs_volume_encryption(Check):
    def execute(self):
        findings = []
        for volume in ec2_client.volumes:
            report = Check_Report_AWS(metadata=self.metadata(), resource=volume)
            report.status = "PASS"
            report.status_extended = f"EBS Snapshot {volume.id} is encrypted."
            if not volume.encrypted:
                report.status = "FAIL"
                report.status_extended = f"EBS Snapshot {volume.id} is unencrypted."
            findings.append(report)

        return findings

References