Back to Checks
huaweicloud

EVS volumes are encrypted

evs_volume_encryption
Service: evsSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:NotDefined

Ensure that all Huawei Cloud Elastic Volume Service (EVS) disks are encrypted to protect data at rest.

Prowler logoProwlerprowler-provider-huaweicloud

Risk

Unencrypted EVS volumes expose sensitive data at rest. If a volume is compromised or improperly accessed, the data can be read without any additional protection.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler huaweicloud --checks evs_volume_encryption

Recommendation

Enable encryption for all EVS volumes using a KMS key.

Remediation

CLI

hcloud EVS CreateVolume --volume.availability_zone=<az> --volume.size=<size> --volume.metadata.__system__encrypted="1" --volume.metadata.__system__cmkid=<kms_key_id>

Other

1Log on to the **Huawei Cloud console**.
2Navigate to **Elastic Volume Service**.
3Select the unencrypted volume.
4Create an **encrypted** volume from a snapshot of the unencrypted volume.
5Replace the old volume with the new encrypted volume.

Check Code

from prowler.lib.check.models import Check, CheckReportHuaweiCloud
from prowler.providers.huaweicloud.services.evs.evs_client import evs_client


class evs_volume_encryption(Check):
    """Check if EVS volumes are encrypted."""

    def execute(self) -> list[CheckReportHuaweiCloud]:
        findings = []

        for volume in evs_client.volumes:
            report = CheckReportHuaweiCloud(metadata=self.metadata(), resource=volume)
            report.region = volume.region
            report.resource_id = volume.id
            report.resource_arn = f"huaweicloud:evs:{volume.region}:{evs_client.audited_account}:volume/{volume.id}"

            if volume.is_encrypted:
                report.status = "PASS"
                report.status_extended = (
                    f"EVS volume {volume.name} ({volume.id}) is encrypted."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"EVS volume {volume.name} ({volume.id}) is not encrypted."
                )

            findings.append(report)

        return findings

References