# Ensure there are no EBS Volumes unencrypted

- Source: https://support.icompaas.com/support/solutions/articles/62000086776-ensure-there-are-no-ebs-volumes-unencrypted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [HIPAA Readiness](https://support.icompaas.com/support/solutions/62000039493) › [AWS - HIPAA](https://support.icompaas.com/support/solutions/folders/62000060465)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description:** 

Elastic Block Store is a web service that provides block-level storage volumes for use with EC2 instances. EBS volumes are highly available and reliable storage volumes that can be attached to any running instance and used as a hard drive.

**Rationale:**

EBS encrypts your volume with a data key using the industry-standard AES-256 algorithm. Unencrypted EBS volumes mean the data stored in your AWS EBS volumes might be at risk of a potential security attack. 

**Impact:**

With Amazon EBS encryption, you aren't required to build, maintain, and secure your own key management infrastructure. Amazon EBS encryption uses AWS KMS keys when creating encrypted volumes.

**Default Value:**

By default, EBS volumes are not encrypted.

**Audit:**

1.  Log in to the AWS Management Console.
    
2.  Go to EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/")
    
3.  Click on **Volumes**, in the navigation panel
    
4.  Select the EBS volume you want to examine
    
5.  Go to the Description tab at the bottom
    
6.  Check the **Encrypted** section.
    

  

![](https://support.icompaas.com/assets/kb/1bd835f7fcd0a3ca.png)

If you notice encryption is Not Encrypted it means the volume is not encrypted.

  

**Using AWS CLI:**

To describe a volume

aws ec2 describe-volumes \\  
    --volume-ids vol-049df61146c4d7901 vol-1234567890abcdef0

  

**Remediation:**

**Pre-requisites:**

-   Sign in as an admin or IAM user with the required permissions
    
-   Take a snapshot of the volume as a backup 
    

**Implementation Steps:**

1.  Log in to the AWS Management Console.
    
2.  Go to EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/")
    
3.  Click on **Volumes**, in the navigation panel.![](https://support.icompaas.com/assets/kb/bc2fa777059f0e54.png)
    
4.  Select EBS volume
    
5.  Click on **Actions** and select **create snapshot.![](https://support.icompaas.com/assets/kb/40ba072c22facdb9.png)**
    
6.  **In the create snapshot page enter the details requires and click on **create snapshot** .![](https://support.icompaas.com/assets/kb/058b0a0a22ca3f2f.png)**
    
7.  **ick on **Snapshots** in the left navigation pane ![](https://support.icompaas.com/assets/kb/b3732d96afe604f9.png)** 
    
8.  Select the snapshot that you just create.
9.  Click on **Actions** and select **Create Volume.![](https://support.icompaas.com/assets/kb/f2d6f43603c6793f.png)**
10.  **On create, volume page make sure **Encryption is enabled** and click on **create volume** button at the bottom .![](https://support.icompaas.com/assets/kb/04ba6658b757ef4e.png)**
11.  Go back to volumes by clicking on **volumes** in the left navigation pane
12.  Select the **old unencrypted volume**, Click on **Actions**, and select **Detach Volume![](https://support.icompaas.com/assets/kb/74bee303844ddbd0.png)**
13.  Select the **volume you just created** from the snapshot.
14.  Click on **Actions** and select **Attach volumes.![](https://support.icompaas.com/assets/kb/40c138d38b114cf7.png)**
15.  **Enter the Instance ID that you want to attach this volume and click on Attach.![](https://support.icompaas.com/assets/kb/c82c7cee6fc833b7.png)**

  

**Using AWS CLI:**

To enable EBS encryption by default

To enable EBS encryption by default

**Backout plan:**

In case of any data loss or corruption during the implementation process, you can get the data from the snapshot you created as a backup.

1.  Log in to the AWS Management Console.
    
2.  Go to EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/ "https://console.aws.amazon.com/ec2/")
    
3.  Click on **Snapshots** in the left navigation pane
    
4.  Click on **Actions** and select **Create Volume**
    

**Using AWS CLI:**

To disable EBS encryption by default

aws ec2 disable-ebs-encryption-by-default

**Reference:**

[![](https://support.icompaas.com/assets/kb/976b960fc74a38a5.png)Amazon EBS encryption - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)

## Related compliance guidance

- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The Security Rule safeguards this readiness item belongs to, with a phased implementation roadmap and the evidence OCR expects.
- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most healthcare customers ask for a SOC 2 report alongside HIPAA assurances; the two share most technical controls.