Rule: EBS Default Encryption Should Be Enabled

Rule Description:

Troubleshooting Steps:

2. 1.
   Verify Encryption Status: Check the encryption status of the existing EBS volumes within your AWS account.
4. 2.
   Check Default Encryption Setting: Verify if the default encryption setting is set to "Enabled" for EBS volumes.
6. 3.
   Review Encryption Key Policy: Ensure that the AWS Key Management Service (KMS) encryption key policy allows encryption and decryption operations for the appropriate users or roles.
8. 4.
   Check IAM Permissions: Confirm that the IAM roles and policies associated with the AWS account have the necessary permissions to enable default encryption for EBS volumes.

Necessary Code:

Enable Default Encryption for EBS volumes:

$ aws ec2 modify-default-credit-specification --region <region-name> --enable-default-encryption

Verify Encryption Status of EBS volumes:

$ aws ec2 describe-volumes --region <region-name> --query "Volumes[*].{ID:VolumeId, Encrypted:Encrypted}"

Remediation Steps:

2. 1.

   Verify Default Encryption Status:

   • Run the following AWS CLI command to check the default encryption status:

   $ aws ec2 describe-account-attributes --query "AccountAttributes[?AttributeName=='default-vpc'].AttributeValues[0].AttributeValue"
   

   • If the output is

     true

     , default encryption is already enabled. Proceed to the next step. If it is

     false

     , continue with the remediation steps.
4. 2.

   Enable Default Encryption:

   • Execute the following AWS CLI command to enable default encryption for EBS volumes:

   $ aws ec2 modify-default-credit-specification --region <region-name> --enable-default-encryption
   

   • Replace

     <region-name>

     with the appropriate AWS region where you want to enable default encryption.
   • This command sets the default encryption attribute to

     true

     .
6. 3.

   Verify Encryption Status of EBS volumes:

   • Run the below AWS CLI command to verify the encryption status of existing EBS volumes:

   $ aws ec2 describe-volumes --region <region-name> --query "Volumes[*].{ID:VolumeId, Encrypted:Encrypted}"
   

   • Replace

     <region-name>

     with the appropriate AWS region.
   • Check the output. If all EBS volumes have the

     Encrypted

     value as

     true

     , default encryption is successfully enabled. Otherwise, proceed to the next step.
8. 4.

   Troubleshoot Encryption Issues:

   • If the encryption status for some or all EBS volumes is not

     true

     , check the AWS Key Management Service (KMS) encryption key policy to ensure it allows encryption and decryption operations. Adjust the policy if necessary.
   • Confirm that the IAM roles and policies associated with the AWS account have the necessary permissions to enable default encryption for EBS volumes.
   • Repeat steps 1 and 3 to verify the encryption status after making any policy or permission changes.