# Ensure EBS default encryption is enabled - Source: https://support.icompaas.com/support/solutions/articles/a_179329219938888-ensure-ebs-default-encryption-is-enabled - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that Amazon EBS encryption by default is turned on in each region. With this setting, every new EBS volume and snapshot copy created in the region is automatically encrypted with AWS KMS, using either the AWS managed key aws/ebs or a customer managed key chosen as the default. Regions that contain no EBS volumes are not evaluated. **Rationale** Without encryption by default, new EBS volumes and snapshots can be created unencrypted, either by mistake or by tools and templates that do not set encryption. Data on these volumes is then stored in plaintext, and a compromised account or a wrongly shared snapshot can expose the disk contents for offline analysis and data theft. Turning on encryption by default in every region, preferably with a customer managed KMS key, removes this risk for all new storage. **Impact** - Ensures that all new EBS volumes and snapshot copies in the region are encrypted - Has no effect on existing volumes or snapshots, which keep their current encryption state - Users and roles that create or attach volumes need permission to use the default KMS key; if a customer managed key is chosen, its key policy must allow them **Default Value** EBS encryption by default is turned off in every region. When it is turned on without choosing a key, the AWS managed key aws/ebs is used. **Pre-Requisites** - IAM permissions: ec2:GetEbsEncryptionByDefault, ec2:EnableEbsEncryptionByDefault, ec2:GetEbsDefaultKmsKeyId and ec2:ModifyEbsDefaultKmsKeyId - Optionally, a customer managed KMS key in each region, with a key policy that allows the users, roles and services that create volumes to use it **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and choose **Dashboard**. 3. Under **Account attributes**, choose **Data protection and security**. 4. In the **EBS encryption** section, check whether **Always encrypt new EBS volumes** is enabled. 5. Repeat for each region in use. 6. If encryption by default is disabled in a region that has EBS volumes, follow the implementation steps. **CLI:** Show whether encryption by default is enabled in a region: aws ec2 get-ebs-encryption-by-default --region Show the default KMS key used for EBS encryption: aws ec2 get-ebs-default-kms-key-id --region A region fails if EbsEncryptionByDefault is false. Only regions that contain at least one EBS volume are evaluated. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and choose **Dashboard**. 3. Under **Account attributes**, choose **Data protection and security**. 4. In the **EBS encryption** section, choose **Manage**. 5. Select **Enable** for **Always encrypt new EBS volumes**. 6. Optionally, choose a customer managed key as the **Default encryption key**. 7. Choose **Update EBS encryption**. 8. Repeat for each region in use. **CLI:** Turn on encryption by default in the region: aws ec2 enable-ebs-encryption-by-default --region Optionally, set a customer managed key as the default key: aws ec2 modify-ebs-default-kms-key-id --kms-key-id --region **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and choose **Dashboard**. 3. Under **Account attributes**, choose **Data protection and security**. 4. In the **EBS encryption** section, choose **Manage**. 5. Clear **Enable** for **Always encrypt new EBS volumes** and choose **Update EBS encryption**. **CLI:** aws ec2 disable-ebs-encryption-by-default --region aws ec2 reset-ebs-default-kms-key-id --region Note: volumes encrypted while the setting was on stay encrypted. Rolling back allows new unencrypted volumes to be created again. **Reference** - [https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) - [https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html) - [https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/](https://aws.amazon.com/premiumsupport/knowledge-center/ebs-automatic-encryption/) - [https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ebs-encryption-by-default.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ebs-encryption-by-default.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.