All checks
Medium
Attached EBS volumes should be encrypted at-rest
Confirms that EBS volumes attached to an instance are encrypted at rest, which also protects their snapshots and the data moving between volume and instance. Encryption is fixed when a volume is created; EBS encryption by default (EC2.7) encrypts new volumes in the Region, not this one.
- service
- EC2
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Snapshots → a snapshot of this volume → Actions → Create volume from snapshot
With the AWS CLI
aws ec2 create-volume --availability-zone <availability-zone> --snapshot-id <snapshot-id> --encrypted --region <region>With Terraform
resource "aws_ebs_volume" "this" {
availability_zone = var.availability_zone
snapshot_id = var.snapshot_id
encrypted = true
}See which of your accounts this check is failing on.
Book a demo