EBS Volumes Should Be Encrypted

More Info:

Ensure that all your Amazon Elastic Block Store (EBS) volumes are encrypted in order to meet security and compliance requirements. With encryption enabled, your EBS volumes can hold sensitive, confidential, and critical data. The data encryption and decryption process is handled transparently and does not require any additional action from you, your server instance, or your application.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• AWS Startup Security Baseline
• AWS Well Architected Framework
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• GDPR
• HIPAA
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of enabling volume encryption in AWS, you can follow the below steps using the AWS Management Console:

1. Open the AWS Management Console and navigate to the EC2 dashboard.

2. From the left-hand side menu, select 'Volumes'.

3. Identify the volume that needs to be encrypted and select it.

4. From the 'Actions' dropdown menu, select 'Create Snapshot'.

5. In the 'Create Snapshot' window, provide a name and description for the snapshot and click on 'Create Snapshot'.

6. Once the snapshot is created, select the original volume again and from the 'Actions' dropdown menu, select 'Create Volume'.

7. In the 'Create Volume' window, select the same availability zone as the original volume, choose the snapshot that was just created, and enable 'Encryption' option.

8. Click on 'Create Volume' to create the new encrypted volume.

9. Once the new volume is created, detach the original volume and attach the new encrypted volume to the instance.

10. Finally, verify that the new encrypted volume is attached and working properly.

By following these steps, you will be able to remediate the misconfiguration of enabling volume encryption in AWS.

Using CLI

Here are the step by step instructions to enable volume encryption for AWS using AWS CLI:

1. Open the AWS CLI on your local machine or EC2 instance.

2. Run the following command to enable encryption for a new EBS volume:

aws ec2 create-volume --availability-zone <availability-zone> --size <size> --encrypted

Replace <availability-zone> with the availability zone where you want to create the volume and <size> with the size of the volume in GiB.

3. If you want to enable encryption for an existing EBS volume, you can use the following command:

aws ec2 modify-volume --volume-id <volume-id> --encrypted

Replace <volume-id> with the ID of the volume you want to encrypt.

4. You can also enable encryption for multiple volumes at once using a JSON file. Create a JSON file with the following format:

{
    "Volumes": [
        {
            "VolumeId": "<volume-id-1>",
            "Encrypted": true
        },
        {
            "VolumeId": "<volume-id-2>",
            "Encrypted": true
        }
    ]
}

Replace <volume-id-1> and <volume-id-2> with the IDs of the volumes you want to encrypt.

5. Save the JSON file and run the following command to enable encryption for the volumes listed in the file:

aws ec2 modify-volume --cli-input-json file://<path-to-json-file>

Replace <path-to-json-file> with the path to the JSON file you created.

6. Verify that encryption is enabled for your volumes by running the following command:

aws ec2 describe-volumes --volume-ids <volume-id>

Replace <volume-id> with the ID of the volume you want to check.

You should see "Encrypted": true in the output if encryption is enabled.

Using Python

To enable volume encryption in AWS using Python, you can follow these steps:

1. Import the necessary libraries:

import boto3

2. Create an EC2 client object:

ec2 = boto3.client('ec2')

3. Get a list of all the volumes in your account:

volumes = ec2.describe_volumes()

4. Loop through the volumes and check if they are already encrypted:

for volume in volumes['Volumes']:
    if not volume['Encrypted']:

5. If the volume is not encrypted, enable encryption:

        response = ec2.modify_volume(
            VolumeId=volume['VolumeId'],
            Encrypted=True
        )

6. Print a message indicating that the encryption has been enabled:

        print('Volume {} has been encrypted.'.format(volume['VolumeId']))

7. If the volume is already encrypted, print a message indicating that no action was taken:

    else:
        print('Volume {} is already encrypted.'.format(volume['VolumeId']))

Putting it all together, the complete Python code to enable volume encryption in AWS would look like this:

import boto3

ec2 = boto3.client('ec2')
volumes = ec2.describe_volumes()

for volume in volumes['Volumes']:
    if not volume['Encrypted']:
        response = ec2.modify_volume(
            VolumeId=volume['VolumeId'],
            Encrypted=True
        )
        print('Volume {} has been encrypted.'.format(volume['VolumeId']))
    else:
        print('Volume {} is already encrypted.'.format(volume['VolumeId']))

Note: This code assumes that you have the necessary permissions to modify volumes in your AWS account.

Using Terraform

# Encrypted replacement for an existing unencrypted EBS data volume,
# following the same flow as the CLI (snapshot → encrypted copy → new volume → attach).

# 1. Snapshot the existing unencrypted volume
resource "aws_ebs_snapshot" "SOURCE_UNENCRYPTED_SNAPSHOT" {
  volume_id   = "UNENCRYPTED_VOLUME_ID" # replace with the existing volume ID
  description = "Snapshot for encrypting UNENCRYPTED_VOLUME_ID"
}

# 2. Create an encrypted copy of the snapshot
resource "aws_ebs_snapshot_copy" "ENCRYPTED_SNAPSHOT_COPY" {
  source_snapshot_id = aws_ebs_snapshot.SOURCE_UNENCRYPTED_SNAPSHOT.id
  source_region      = "SOURCE_REGION_CODE" # e.g. "us-east-1"
  encrypted          = true

  # Optional: use a specific KMS key
  # kms_key_id = "KMS_KEY_ARN_OR_ID"

  description = "Encrypted copy for UNENCRYPTED_VOLUME_ID"
}

# 3. Create a new, encrypted volume from the encrypted snapshot
resource "aws_ebs_volume" "ENCRYPTED_DATA_VOLUME" {
  availability_zone = "AVAILABILITY_ZONE" # e.g. "us-east-1a"
  snapshot_id       = aws_ebs_snapshot_copy.ENCRYPTED_SNAPSHOT_COPY.id

  # Optional: match size/type/iops/etc. of the original volume
  # size              = 100
  # type              = "gp3"
  # iops              = 3000
  # throughput        = 125
}

# 4 & 5. Attach the new encrypted volume to the instance
# NOTE: You must manually stop the instance and detach the old volume
# to avoid data corruption, just as in the CLI procedure.
resource "aws_volume_attachment" "ENCRYPTED_DATA_ATTACHMENT" {
  device_name = "DEVICE_NAME"          # e.g. "/dev/sdf"
  instance_id = "INSTANCE_ID"          # ID of the EC2 instance
  volume_id   = aws_ebs_volume.ENCRYPTED_DATA_VOLUME.id
}

Substitute:

• UNENCRYPTED_VOLUME_ID with the current unencrypted EBS volume ID.
• SOURCE_REGION_CODE with the region of the original snapshot/volume (for example, us-east-1).
• AVAILABILITY_ZONE with the AZ where the volume must live (for example, us-east-1a).
• DEVICE_NAME with the existing device name on the instance (for example, /dev/sdf).
• INSTANCE_ID with the EC2 instance ID.
• Optionally set kms_key_id, size, type, etc., to match your requirements.

This change does not modify the existing unencrypted volume in place; it creates a new encrypted volume. Detaching the old volume and attaching the new one is disruptive and requires instance downtime, especially for any in-use filesystem. For root volumes, additional boot and OS steps are required beyond this Terraform.

After you have verified the new encrypted volume works and data is intact, you should remove the Terraform (and actual AWS resources) for the old unencrypted volume and any temporary snapshots to avoid cost.

For verification, terraform plan should show:

• creation of aws_ebs_snapshot.SOURCE_UNENCRYPTED_SNAPSHOT
• creation of aws_ebs_snapshot_copy.ENCRYPTED_SNAPSHOT_COPY with encrypted = true
• creation of aws_ebs_volume.ENCRYPTED_DATA_VOLUME from the encrypted snapshot
• creation of aws_volume_attachment.ENCRYPTED_DATA_ATTACHMENT attaching the new encrypted volume to the instance
• (and, once you delete any old unencrypted volume/attachment resources from Terraform, their destruction).

Additional Reading:

• https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html