Back to Checks
aws

Amazon WorkSpaces workspace root and user volumes are encrypted

workspaces_volume_encryption_enabled
Service: workspacesSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:AwsEc2Volume

Amazon WorkSpaces evaluates encryption at rest on each workspace's EBS volumes. It checks whether the root and user volumes are encrypted with a KMS key and identifies workspaces where either volume is unencrypted.

Prowler logoProwlerprowler-provider-aws

Risk

Unencrypted volumes allow offline access to files, cached credentials, and profile data from snapshots or underlying storage, harming confidentiality. Storage-level access can enable data tampering, impacting integrity, and facilitate token reuse for lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks workspaces_volume_encryption_enabled

Recommendation

Enable KMS-backed encryption for both root and user volumes on all WorkSpaces. Prefer customer-managed keys, enforce least privilege on key use, and enable rotation. Embed encryption into provisioning templates and policies to block unencrypted launches. Keep required keys enabled for rebuilds and restores.

Remediation

Terraform

# Terraform: create a WorkSpace with both volumes encrypted
resource "aws_workspaces_workspace" "example" {
  bundle_id    = "<example_bundle_id>"
  directory_id = "<example_directory_id>"
  user_name    = "<example_user_name>"

  root_volume_encryption_enabled = true  # Critical: encrypts the root volume
  user_volume_encryption_enabled = true  # Critical: encrypts the user volume
}

NativeIaC

# CloudFormation: create a WorkSpace with both volumes encrypted
Resources:
  ExampleWorkspace:
    Type: AWS::WorkSpaces::Workspace
    Properties:
      BundleId: <example_bundle_id>
      DirectoryId: <example_directory_id>
      UserName: <example_user_name>
      RootVolumeEncryptionEnabled: true  # Critical: encrypts the root volume to pass the check
      UserVolumeEncryptionEnabled: true  # Critical: encrypts the user volume to pass the check

Other

1In the AWS Console, go to WorkSpaces > WorkSpaces and click Launch WorkSpaces
2Select the directory and user, proceed to the WorkSpaces Configuration step
3Under Encryption, enable Root volume and User volume
4Keep the default AWS managed key (aws/workspaces) or select a CMK if required
5Launch the WorkSpace, then migrate the user and terminate the unencrypted WorkSpace
6Verify the Volume Encryption column shows Enabled for both volumes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.workspaces.workspaces_client import (
    workspaces_client,
)


class workspaces_volume_encryption_enabled(Check):
    def execute(self):
        findings = []
        for workspace in workspaces_client.workspaces:
            report = Check_Report_AWS(metadata=self.metadata(), resource=workspace)
            report.status = "PASS"
            report.status_extended = f"WorkSpaces workspace {workspace.id} root and user volumes are encrypted."
            if not workspace.user_volume_encryption_enabled:
                report.status = "FAIL"
                report.status_extended = f"WorkSpaces workspace {workspace.id} with user unencrypted volumes."
            if not workspace.root_volume_encryption_enabled:
                report.status = "FAIL"
                report.status_extended = f"WorkSpaces workspace {workspace.id} with root unencrypted volumes."
            if (
                not workspace.root_volume_encryption_enabled
                and not workspace.user_volume_encryption_enabled
            ):
                report.status = "FAIL"
                report.status_extended = f"WorkSpaces workspace {workspace.id} with root and user unencrypted volumes."

            findings.append(report)
        return findings

References