Description

Ensure that every Amazon EBS snapshot owned by the account is encrypted at rest with AWS KMS. An existing unencrypted snapshot cannot be encrypted in place; an encrypted copy must be created and the unencrypted original deleted.

Rationale

An unencrypted snapshot contains a complete, readable image of a disk. Anyone who gains access to it, or receives it through incorrect sharing, can create a volume from it and read the data, harvest credentials or analyze the system offline. Encrypting all snapshots with AWS KMS, preferably with customer managed keys, and turning on EBS encryption by default prevents new unencrypted snapshots and adds key-based access control.

Impact

  • Protects snapshot data at rest and adds KMS key-based access control

  • Volumes created from an encrypted snapshot are also encrypted

  • The encrypted copy has a new snapshot ID, so backup plans, scripts, launch templates or AMIs that reference the old snapshot ID must be updated

  • Sharing an encrypted snapshot with another account requires a customer managed key that the other account is allowed to use

Default Value

Snapshots inherit the encryption state of their source volume, so snapshots of unencrypted volumes are always unencrypted. EBS encryption by default only encrypts new volumes and new snapshot copies; it does not encrypt existing volumes or snapshots.

Pre-Requisites

  • IAM permissions: ec2:DescribeSnapshots, ec2:CopySnapshot, ec2:DeleteSnapshot and permission to use the KMS key (for example kms:CreateGrant, kms:GenerateDataKeyWithoutPlaintext and kms:Decrypt)

  • Confirmation of which snapshots are still needed, and which processes or AMIs reference them

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Snapshots under Elastic Block Store.

  3. Choose the Owned by me filter.

  4. Check the Encryption column of each snapshot.

  5. Repeat for each region in use.

  6. If any snapshot is Not encrypted, follow the implementation steps.

CLI:

List the unencrypted snapshots owned by the account:

aws ec2 describe-snapshots --owner-ids self --filters Name=encrypted,Values=false --region <REGION> --query "Snapshots[].[SnapshotId,VolumeId,StartTime,Description]" --output table

A snapshot fails if it is listed by this command.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon EC2 console and select Snapshots under Elastic Block Store.

  3. Select the unencrypted snapshot.

  4. Choose Actions, then Copy snapshot.

  5. Select Encrypt this snapshot and choose the KMS key (the default aws/ebs key or a customer managed key).

  6. Choose Copy snapshot and wait until the new snapshot status is Completed.

  7. Update any backup plan, script, launch template or AMI that uses the old snapshot so that it uses the new encrypted snapshot.

  8. Select the original unencrypted snapshot, choose Actions, then Delete snapshot, and confirm. A snapshot used by a registered AMI cannot be deleted until the AMI is deregistered.

  9. Repeat for each affected snapshot in each region in use.

CLI:

Create an encrypted copy of the snapshot in the same region:

aws ec2 copy-snapshot --source-region <REGION> --source-snapshot-id <SNAPSHOT_ID> --encrypted --kms-key-id <KMS_KEY_ARN> --description "Encrypted copy of <SNAPSHOT_ID>" --region <REGION>

Check that the copy has completed:

aws ec2 describe-snapshots --snapshot-ids <NEW_SNAPSHOT_ID> --region <REGION> --query "Snapshots[].[SnapshotId,State,Encrypted]" --output table

Delete the original unencrypted snapshot after the copy has been verified:

aws ec2 delete-snapshot --snapshot-id <SNAPSHOT_ID> --region <REGION>

Backout Plan

  1. Keep the original unencrypted snapshot until the encrypted copy has been verified and all references have been updated.

  2. If the change needs to be reversed before the original is deleted, point the backup plans, scripts, launch templates or AMIs back to the original snapshot ID.

  3. Delete the encrypted copy if it is no longer needed: in the Amazon EC2 console, select it under Snapshots, choose Actions, then Delete snapshot.

CLI:

aws ec2 delete-snapshot --snapshot-id <NEW_SNAPSHOT_ID> --region <REGION>

Note: a deleted snapshot cannot be recovered, unless the Recycle Bin is configured for EBS snapshots. Rolling back leaves the snapshot data unencrypted.

Reference