# Ensure EBS Volume Encryption is Enabled - Source: https://support.icompaas.com/support/solutions/articles/62000233954-ensure-ebs-volume-encryption-is-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/62000112682) › [AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/folders/62000169228) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Profile Applicability:** - **Level 1** **Description:** Elastic Compute Cloud (EC2) supports encryption at rest when using Elastic Block Store (EBS) volumes. While encryption is disabled by default, AWS provides an option to enforce EBS encryption when creating new volumes. Enabling EBS encryption by default ensures that all new EBS volumes created in your account are encrypted, providing data protection and compliance with security requirements. **Rationale:** Encrypting EBS volumes ensures that sensitive data stored at rest is protected from unauthorized access. If encryption is enabled by default, it reduces the likelihood of unintentional data exposure and mitigates the impact if encryption is ever compromised. By enforcing encryption at the EBS volume creation stage, AWS helps ensure that data is securely stored, reducing risks of data leaks or unauthorized access to critical data. **Impact: Pros:** - Increased security by ensuring that all EBS volumes are encrypted at rest. - Helps to meet compliance requirements that mandate data encryption, such as HIPAA, PCI-DSS, and GDPR. - Prevents unintentional exposure of sensitive data by ensuring encryption is enforced for all new volumes. **Cons:** - Performance overhead: There could be slight performance impacts, though AWS has optimized encryption processes to minimize this. - Configuration complexity for regions where encryption is not enabled by default. **Default Value:** By default, EBS encryption is not enabled for new volumes. However, it can be configured per region to enable encryption for all newly created volumes. **Pre-requisites:** - AWS IAM permissions to manage EBS volumes and EC2 instances: ec2:DescribeAccountAttributes, ec2:ModifyAccountAttribute, ec2:EnableEbsEncryptionByDefault, ec2:DescribeImages **Remediation:** **Test Plan:** **Using AWS Console:** 1. Log in to the EC2 Console at [AWS EC2 Console](https://console.aws.amazon.com/ec2/). 2. In the left pane, under Account attributes, click EBS encryption. 3. Ensure that Always encrypt new EBS volumes is enabled. 4. Review this setting across all regions where EBS volumes are used. **Using AWS CLI:** 1. Run the following command to check if EBS encryption by default is enabled for your region: aws ec2 get-ebs-encryption-by-default --region 2. Verify that the response contains "EbsEncryptionByDefault": true. **Implementation Plan:** **Using AWS Console:** 1. Log in to the EC2 Console at [AWS EC2 Console](https://console.aws.amazon.com/ec2/). 2. In the left pane, under Account attributes, click on EBS encryption. 3. Click Manage. 4. Select the Enable checkbox to enable default encryption for new EBS volumes. 5. Click Update EBS encryption to apply the change. 6. Repeat this process for each region where new EBS volumes need to be encrypted by default. **Using AWS CLI:** 1. Run the following command to enable EBS encryption by default: aws ec2 enable-ebs-encryption-by-default --region 2. Verify the setting by running: aws ec2 get-ebs-encryption-by-default --region 3. Repeat this command for all regions requiring encryption for new EBS volumes. **Backout Plan:** **Using AWS Console:** 1. If enabling EBS encryption by default causes issues, log in to the EC2 Console. 2. Under EBS encryption, click Manage. 3. Uncheck the Enable checkbox to disable encryption for new volumes. 4. Click Update EBS encryption to revert the changes. **Using AWS CLI:** 1. To disable EBS encryption by default, run the following command: aws ec2 disable-ebs-encryption-by-default --region 2. Verify the setting by running: aws ec2 get-ebs-encryption-by-default --region **References:** 1. [AWS EC2: EBS Encryption](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html) 2. [AWS CLI: get-ebs-encryption-by-default](https://docs.aws.amazon.com/cli/latest/reference/ec2/get-ebs-encryption-by-default.html) 3. [AWS CLI: enable-ebs-encryption-by-default](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ebs-encryption-by-default.html) **CIS Controls:**

Version	Control ID	Control Description
v8	3.11	Encrypt sensitive data at rest on all EBS volumes, ensuring that data on Amazon EC2 instances is protected from unauthorized access.
v7	14.8	Encrypt all sensitive data at rest, including on EBS volumes, to ensure that data remains protected and inaccessible without proper authorization.

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.