Other Articles
- IAM - Enable User MFA
- IAM - Enforce Key Rotation
- IAM - Enforce Active Key Limit
- IAM - Disable Unused User Credentials
- IAM - Enforce Group Permission
- IAM - Enforce Password Length
- IAM - Prohibit Password Reuse
- IAM - Check Root Access Keys Existence
- IAM - Enable Root MFA
- IAM - Establish Support Role
- IAM - Enable Key Rotation
- Purge Expired Certificates
- EC2 Volume – Enable EBS Volume Backup
- EFS – Enable EFS Storage Backup
- S3 Bucket – Enable S3 Bucket Versioning
- S3 Bucket – Enable S3 Bucket Encryption
- S3 Bucket – Block S3 Bucket Public Access
- RDS DB Instance – Encryption of Storage
- RDS DB Instance – Enable Deletion Protection
- RDS DB Instance – Enable Auto Minor Version Upgrade
- DynamoDB Table – Enable Table Encryption
- DynamoDB Table – Enable Table Point In Time Recovery
- DynamoDB Table – Enable Table Deletion Protection
- EC2 Instance – Monitor CPU Utilization
- ECS Service – Monitor CPU Utilization
- ECS Service – Monitor Memory Utilization
- RDS DB Instance – Monitor Free Storage Space
- RDS DB Instance – Monitor CPU Utilization
- SQS Queue – Monitor Message Age
- SQS Queue – Monitor Message Visibility
- DynamoDB Table – Monitor Table Read Capacity
- DynamoDB Table – Monitor Table Write Capacity
- DynamoDB Table – Monitor Table Latency
- Enable CloudTrail
- Encrypt CloudTrail Logs
- EC2 VPC – Ensure Flow Logs are Enabled
- RDS DB Instance – Block Public Access
- EC2 Instance – Enable Deletion Protection
- ECS Service – Enable Auto Scaling
- Enable AWS Security Hub
- Enable GuardDuty
EC2 Volume – Enable EBS Encryption
Secure Configuration Checks > AWS
This check ensures that default encryption is enabled for Amazon EBS volumes. Enabling encryption helps protect sensitive data stored on EC2 volumes and supports compliance and security best practices.
Check Details
- Resource: EC2 Volume
- Check: Enable encryption of EBS volumes
- Risk: Unencrypted volumes may expose sensitive data
Remediation via AWS Console
-
Log in to the AWS Management Console and open the Amazon EC2 service.
-
Under Settings, select Data protection and security.
- Under EBS encryption, click Manage.
-
Enable default encryption and click Update EBS encryption.
- Repeat these steps for each AWS region where default EBS encryption is not enabled.
Remediation via AWS CLI
-
Log in to the AWS Management Console and click the CloudShell icon (
>_) in the top-right corner.
-
Run the following command to enable default EBS encryption for the required AWS region:
aws --region <region> ec2 enable-ebs-encryption-by-default
-
Verify that the output confirms encryption is enabled:
{ "EbsEncryptionByDefault": true } -
Repeat these steps for each AWS region where default EBS encryption is not enabled.
Updated on 06 March, 2026