Rule: Attached EBS volumes should have encryption enabled
This rule ensures that EBS volumes are secure with encryption enabled.
| Rule | Attached EBS volumes should have encryption enabled |
| Framework | CISA-cyber-essentials |
| Severity | ✔ Medium |
Rule Description
The rule requires that all attached EBS (Elastic Block Store) volumes should have encryption enabled. This is a mandatory security measure to comply with the CISA Cyber Essentials guidelines.
Troubleshooting Steps
If an attached EBS volume does not have encryption enabled, follow the steps below for troubleshooting:
- 1.
Verify Encryption Status: Check the encryption status of the EBS volume by logging into the AWS Management Console or using the AWS CLI (Command Line Interface).
- 2.
Encryption Not Enabled: If the encryption status shows as "Not Enabled," proceed with the remediation steps.
Remediation Steps
To enable encryption for an attached EBS volume, follow the step-by-step guide below:
Using AWS Management Console
- 1.
Log into the AWS Management Console.
- 2.
Navigate to the Amazon EC2 dashboard.
- 3.
Select "Volumes" from the sidebar menu.
- 4.
Identify the unencrypted EBS volume that needs encryption enabled.
- 5.
Right-click on the volume, and select "Modify Volume."
- 6.
In the "Modify Volume" dialog box, select the encryption option.
- 7.
Choose the desired encryption key or create a new one.
- 8.
Click on "Modify" to apply the changes.
Using AWS CLI
- 1.
Install and configure the AWS CLI on your local machine if not already done.
- 2.
Open the command-line interface or terminal.
- 3.
Run the following command to enable encryption for an EBS volume:
aws ec2 modify-volume --volume-id <volume-id> --encryptedReplace
with the actual ID of the unencrypted volume.<volume-id> - 4.
Verify the encryption status using the following command:
aws ec2 describe-volumes --volume-ids <volume-id> --query "Volumes[].{ID:VolumeId,Encryption:Encrypted}" --output tableReplace
with the actual ID of the volume.<volume-id>
Additional Notes
Enabling encryption for attached EBS volumes ensures that data on the volumes is protected at rest.
Regularly audit and monitor EBS volumes to ensure compliance with the CISA Cyber Essentials requirements.
It is recommended to automate the encryption process using infrastructure-as-code tools like AWS CloudFormation or AWS CDK, to ensure consistent deployment and compliance across multiple instances and volumes.