EBS default encryption is not enabled for this region

Severity: Medium
Service: EC2
Check ID: EBS_DEFAULT_ENCRYPTION_DISABLED

What this check finds

When EBS default encryption is off, new volumes and snapshots created without an explicit encryption setting are unencrypted. Enabling it ensures all future EBS resources are encrypted at rest without requiring per-resource configuration. CIS v5.0 §5.1.1.

Passing looks like: EBS default encryption enabled.

How to fix it

Enable EBS encryption by default for the region.

AWS CLI

aws ec2 enable-ebs-encryption-by-default --region REGION

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

EC2 → Account attributes → EBS encryption → Manage → Enable. This only affects newly created volumes; existing unencrypted volumes must be migrated separately.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to EBS default encryption is not enabled for this region
Framework	Controls
CIS AWS Foundations Benchmark v5.0.0	5.1.1 Ensure EBS volume encryption is enabled in all regions
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest 164.310(d) Device and Media Controls
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More EC2 checks

All EC2 checks