EBS volume is not encrypted at rest

Severity: Medium
Service: EC2
Check ID: EBS_VOLUME_UNENCRYPTED

What this check finds

EBS volumes store data persistently. Unencrypted volumes expose data if the underlying hardware is compromised or a snapshot is shared. Encryption at rest is a compliance baseline for PCI-DSS, HIPAA, and SOC 2.

Passing looks like: EBS volumes encrypted at rest.

How to fix it

Create a new encrypted volume and copy data to it, or enable EBS encryption by default for the account. CLI to enable account-level default: aws ec2 enable-ebs-encryption-by-default. To encrypt an existing volume: create a snapshot, copy it with --encrypted flag, restore to a new volume.

AWS console

EC2 → Volumes → select volume → Actions → Create snapshot, then copy snapshot with encryption.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to EBS volume is not encrypted at rest
Framework	Controls
PCI-DSS v4.0.1	3.5 Primary account number (PAN) is secured wherever it is stored
HIPAA Security Rule	164.312(a)(2)(iv) Encryption and Decryption of ePHI at Rest 164.310(d) Device and Media Controls
SOC 2 — Trust Services Criteria	CC6.7 Encryption and Secret Management C1.1 Encryption of Confidential Data
NIST SP 800-53 Rev5 (Moderate)	SC-13 Cryptographic Protection SC-28 Protection of Information at Rest
NIST Cybersecurity Framework 2.0	PR.DS-01 Data-at-rest is protected
ISO/IEC 27001:2022 Annex A	A.8.24 Use of cryptography

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More EC2 checks

All EC2 checks