# 5.1.1 Ensure EBS Volume Encryption is Enabled in All Regions (Automated)

- Source: https://support.icompaas.com/support/solutions/articles/62000233172-5-1-1-ensure-ebs-volume-encryption-is-enabled-in-all-regions-automated-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS CIS V.4 Level 1 Benchmarks](https://support.icompaas.com/support/solutions/62000112671) › [CIS Control 5](https://support.icompaas.com/support/solutions/folders/62000169192)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### Profile Applicability:

**Level 1**

## Description:

Elastic Block Store (EBS) provides encryption at rest for Amazon EC2 instances. While EBS encryption is disabled by default, AWS allows users to enable encryption by default to ensure all newly created volumes are automatically encrypted using AWS Key Management Service (KMS) keys.

## Rationale:

Encrypting data at rest ensures confidentiality and compliance by:

-   Reducing the risk of unauthorized access to sensitive data.
    
-   Preventing data exposure in the event of a security breach.
    
-   Aligning with compliance standards such as SOC 2, HIPAA, PCI DSS, and CIS Benchmark standards.
    

Impact:

-   Enabling default encryption affects only new EBS volumes. Existing volumes are not automatically encrypted.
    
-   Losing access to the KMS key used for encryption may result in data inaccessibility.
    
-   Additional permissions are required for instances and users accessing encrypted volumes.
    

## Default Value:

-   EBS encryption is disabled by default for all AWS regions.
    
-   Users must enable encryption per region for all new EBS volumes.
    

## Pre-Requisites:

1.  AWS CLI Installed (for command-line verification and remediation).
    
2.  IAM Permissions Required:
    
    -   ec2:GetEbsEncryptionByDefault (for auditing).
        
    -   ec2:EnableEbsEncryptionByDefault (for remediation).
        
3.  Access to AWS Management Console with permissions to modify EBS encryption settings.
    
4.  AWS Key Management Service (KMS) key for encryption (AWS-managed or customer-managed).
    

  
Remediation

### Test Plan:

## Using AWS Console

1.  Login to the AWS Management Console.
    
2.  Open the Amazon EC2 console: [AWS EC2 Console](https://console.aws.amazon.com/ec2/).
    
3.  Under Account Attributes, click EBS encryption.
    

                  ![](https://support.icompaas.com/assets/kb/877465d857edead4.png)

4.  Verify that "Always encrypt new EBS volumes" displays Enabled.
    

                ![](https://support.icompaas.com/assets/kb/9390af039630822a.png)

5.  Repeat for each AWS region in use.
    

## Implementation Steps:  
Using AWS Console

1.  Login to the AWS Management Console.
    
2.  Open the Amazon EC2 console: [AWS EC2 Console](https://console.aws.amazon.com/ec2/).  
      
    ![](https://support.icompaas.com/assets/kb/cd1a8218f979cb13.png)  
      
    
3.  Under Account Attributes, click EBS encryption.                          ![](https://support.icompaas.com/assets/kb/c202078fbb235c14.png)                          
    
4.  Click Manage.
    

               ![](https://support.icompaas.com/assets/kb/576be4dcd81dfdcc.png)

5.  Check the Enable box to enable encryption for new EBS volumes.
    
6.  Click Update EBS encryption.
    

![](https://support.icompaas.com/assets/kb/dbc210ca7d9cb5e5.png)

7.  Repeat for all AWS regions where encryption is not enabled.
    

## Backout Plan:

If enabling EBS encryption causes issues:

1.  Disable EBS encryption for new volumes:
    
    aws --region <region-name> ec2 disable-ebs-encryption-by-default
    
2.  Verify encryption status:
    
    aws --region <region-name> ec2 get-ebs-encryption-by-default
    

-   Expected Output: "EbsEncryptionByDefault": false.
    

3.  Ensure existing encrypted volumes remain accessible.  
    

## References:

-   [AWS EBS Encryption Documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html)
    
-   [AWS Default EBS Encryption Guide](https://aws.amazon.com/blogs/aws/new-opt-in-to-default-encryption-for-new-ebs-volumes/)
    

## CIS Controls Mapping:  
  

<table style="border:none;border-collapse:collapse"><colgroup style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"></colgroup><tbody><tr style="height:39.25pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:left;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:700;font-family:&quot;Helvetica Neue&quot;">CIS Control Version</span></span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:left;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:700;font-family:&quot;Helvetica Neue&quot;">Control ID</span></span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:700;font-family:&quot;Helvetica Neue&quot;">Control Description</span></span></span></span></p></td></tr><tr style="height:39.25pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px;text-align:justify"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:400;font-family:&quot;Helvetica Neue&quot;">CIS v8</span></span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px;text-align:justify"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:400;font-family:&quot;Helvetica Neue&quot;">3.11</span></span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px;text-align:justify"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:400;font-family:&quot;Helvetica Neue&quot;">Encrypt sensitive data at rest on servers, applications, and databases.</span></span></span></span></p></td></tr><tr style="height:39.25pt"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px;text-align:justify"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:400;font-family:&quot;Helvetica Neue&quot;">CIS v7</span></span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px;text-align:justify"><span style="color:rgb(0, 0, 0)"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="font-weight:400;font-family:&quot;Helvetica Neue&quot;">14.8</span></span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word"><p dir="ltr" style="line-height:1.38;margin-bottom:0pt;text-align:justify"><span style="color:rgb(0, 0, 0)"><span style="font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span dir="ltr" style="font-weight:400">Encrypt all sensitive information at rest with a secondary authentication mechanism.</span></span></span></p></td></tr></tbody></table>

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.