Description

Ensure that Amazon EBS encryption by default is turned on in each region. With this setting, every new EBS volume and snapshot copy created in the region is automatically encrypted with AWS KMS, using either the AWS managed key aws/ebs or a customer managed key chosen as the default. Regions that contain no EBS volumes are not evaluated.

Rationale

Without encryption by default, new EBS volumes and snapshots can be created unencrypted, either by mistake or by tools and templates that do not set encryption. Data on these volumes is then stored in plaintext, and a compromised account or a wrongly shared snapshot can expose the disk contents for offline analysis and data theft. Turning on encryption by default in every region, preferably with a customer managed KMS key, removes this risk for all new storage.

Impact

  • Ensures that all new EBS volumes and snapshot copies in the region are encrypted

  • Has no effect on existing volumes or snapshots, which keep their current encryption state

  • Users and roles that create or attach volumes need permission to use the default KMS key; if a customer managed key is chosen, its key policy must allow them

Default Value

EBS encryption by default is turned off in every region. When it is turned on without choosing a key, the AWS managed key aws/ebs is used.

Pre-Requisites

  • IAM permissions: ec2:GetEbsEncryptionByDefault, ec2:EnableEbsEncryptionByDefault, ec2:GetEbsDefaultKmsKeyId and ec2:ModifyEbsDefaultKmsKeyId

  • Optionally, a customer managed KMS key in each region, with a key policy that allows the users, roles and services that create volumes to use it

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and choose Dashboard.

  3. Under Account attributes, choose Data protection and security.

  4. In the EBS encryption section, check whether Always encrypt new EBS volumes is enabled.

  5. Repeat for each region in use.

  6. If encryption by default is disabled in a region that has EBS volumes, follow the implementation steps.

CLI:

Show whether encryption by default is enabled in a region:

aws ec2 get-ebs-encryption-by-default --region <REGION>

Show the default KMS key used for EBS encryption:

aws ec2 get-ebs-default-kms-key-id --region <REGION>

A region fails if EbsEncryptionByDefault is false. Only regions that contain at least one EBS volume are evaluated.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and choose Dashboard.

  3. Under Account attributes, choose Data protection and security.

  4. In the EBS encryption section, choose Manage.

  5. Select Enable for Always encrypt new EBS volumes.

  6. Optionally, choose a customer managed key as the Default encryption key.

  7. Choose Update EBS encryption.

  8. Repeat for each region in use.

CLI:

Turn on encryption by default in the region:

aws ec2 enable-ebs-encryption-by-default --region <REGION>

Optionally, set a customer managed key as the default key:

aws ec2 modify-ebs-default-kms-key-id --kms-key-id <KMS_KEY_ARN> --region <REGION>

Backout Plan

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and choose Dashboard.

  3. Under Account attributes, choose Data protection and security.

  4. In the EBS encryption section, choose Manage.

  5. Clear Enable for Always encrypt new EBS volumes and choose Update EBS encryption.

CLI:

aws ec2 disable-ebs-encryption-by-default --region <REGION>
aws ec2 reset-ebs-default-kms-key-id --region <REGION>

Note: volumes encrypted while the setting was on stay encrypted. Rolling back allows new unencrypted volumes to be created again.

Reference