Back to Checks
linode

Linode Instance has disk encryption enabled

compute_instance_disk_encryption_enabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:encryption
Resource Type:NotDefined

Linode instances are assessed for disk encryption status. Disk encryption protects data at rest on the instance's underlying disks, keeping stored data unreadable without the encryption keys even if the physical media is accessed.

Prowler logoProwlerprowler-provider-linode

Risk

Without disk encryption, data at rest on the instance's disks is stored unprotected. This increases the risk of data exposure through physical access to decommissioned or stolen storage media, or via certain hypervisor-level vulnerabilities, compromising the confidentiality of sensitive data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler linode --checks compute_instance_disk_encryption_enabled

Recommendation

Enable disk encryption for this instance. Because it cannot be toggled on existing instances, rebuild or migrate to a new instance with encryption enabled.

Remediation

Other

1Disk encryption must be enabled at instance creation time or by rebuilding the instance
2Create a new instance with disk_encryption set to 'enabled'
3Migrate data from the unencrypted instance to the new encrypted instance

Check Code

from prowler.lib.check.models import Check, CheckReportLinode
from prowler.providers.linode.services.compute.compute_client import compute_client


class compute_instance_disk_encryption_enabled(Check):
    """Check if Linode instances have disk encryption enabled."""

    def execute(self) -> list[CheckReportLinode]:
        """Execute the compute_instance_disk_encryption_enabled check.

        Iterates over all Linode instances and checks whether disk encryption
        is enabled.

        Returns:
            list[CheckReportLinode]: A list of findings for each instance.
        """
        findings = []

        for instance in compute_client.instances:
            report = CheckReportLinode(
                metadata=self.metadata(),
                resource=instance,
                resource_name=instance.label,
                resource_id=str(instance.id),
                region=instance.region,
            )
            report.resource_tags = instance.tags

            if instance.disk_encryption == "enabled":
                report.status = "PASS"
                report.status_extended = (
                    f"Instance {instance.label} has disk encryption enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Instance {instance.label} does not have disk encryption enabled."
                )

            findings.append(report)

        return findings

References