# Ensure EBS snapshots are encrypted - Source: https://support.icompaas.com/support/solutions/articles/a_179329220035715-ensure-ebs-snapshots-are-encrypted - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every Amazon EBS snapshot owned by the account is encrypted at rest with AWS KMS. An existing unencrypted snapshot cannot be encrypted in place; an encrypted copy must be created and the unencrypted original deleted. **Rationale** An unencrypted snapshot contains a complete, readable image of a disk. Anyone who gains access to it, or receives it through incorrect sharing, can create a volume from it and read the data, harvest credentials or analyze the system offline. Encrypting all snapshots with AWS KMS, preferably with customer managed keys, and turning on EBS encryption by default prevents new unencrypted snapshots and adds key-based access control. **Impact** - Protects snapshot data at rest and adds KMS key-based access control - Volumes created from an encrypted snapshot are also encrypted - The encrypted copy has a new snapshot ID, so backup plans, scripts, launch templates or AMIs that reference the old snapshot ID must be updated - Sharing an encrypted snapshot with another account requires a customer managed key that the other account is allowed to use **Default Value** Snapshots inherit the encryption state of their source volume, so snapshots of unencrypted volumes are always unencrypted. EBS encryption by default only encrypts new volumes and new snapshot copies; it does not encrypt existing volumes or snapshots. **Pre-Requisites** - IAM permissions: ec2:DescribeSnapshots, ec2:CopySnapshot, ec2:DeleteSnapshot and permission to use the KMS key (for example kms:CreateGrant, kms:GenerateDataKeyWithoutPlaintext and kms:Decrypt) - Confirmation of which snapshots are still needed, and which processes or AMIs reference them **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Snapshots** under **Elastic Block Store**. 3. Choose the **Owned by me** filter. 4. Check the **Encryption** column of each snapshot. 5. Repeat for each region in use. 6. If any snapshot is **Not encrypted**, follow the implementation steps. **CLI:** List the unencrypted snapshots owned by the account: aws ec2 describe-snapshots --owner-ids self --filters Name=encrypted,Values=false --region --query "Snapshots\[\].\[SnapshotId,VolumeId,StartTime,Description\]" --output table A snapshot fails if it is listed by this command. **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the Amazon EC2 console and select **Snapshots** under **Elastic Block Store**. 3. Select the unencrypted snapshot. 4. Choose **Actions**, then **Copy snapshot**. 5. Select **Encrypt this snapshot** and choose the KMS key (the default aws/ebs key or a customer managed key). 6. Choose **Copy snapshot** and wait until the new snapshot status is **Completed**. 7. Update any backup plan, script, launch template or AMI that uses the old snapshot so that it uses the new encrypted snapshot. 8. Select the original unencrypted snapshot, choose **Actions**, then **Delete snapshot**, and confirm. A snapshot used by a registered AMI cannot be deleted until the AMI is deregistered. 9. Repeat for each affected snapshot in each region in use. **CLI:** Create an encrypted copy of the snapshot in the same region: aws ec2 copy-snapshot --source-region --source-snapshot-id --encrypted --kms-key-id --description "Encrypted copy of " --region Check that the copy has completed: aws ec2 describe-snapshots --snapshot-ids --region --query "Snapshots\[\].\[SnapshotId,State,Encrypted\]" --output table Delete the original unencrypted snapshot after the copy has been verified: aws ec2 delete-snapshot --snapshot-id --region **Backout Plan** 1. Keep the original unencrypted snapshot until the encrypted copy has been verified and all references have been updated. 2. If the change needs to be reversed before the original is deleted, point the backup plans, scripts, launch templates or AMIs back to the original snapshot ID. 3. Delete the encrypted copy if it is no longer needed: in the Amazon EC2 console, select it under **Snapshots**, choose **Actions**, then **Delete snapshot**. **CLI:** aws ec2 delete-snapshot --snapshot-id --region Note: a deleted snapshot cannot be recovered, unless the Recycle Bin is configured for EBS snapshots. Rolling back leaves the snapshot data unencrypted. **Reference** - [https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html) - [https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copy-snapshot.html](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-copy-snapshot.html) - [https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html) - [https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.