Rule: Attached EBS Volumes Should Have Encryption Enabled
This rule ensures that all attached EBS volumes have encryption enabled to enhance data security.
| Rule | Attached EBS volumes should have encryption enabled |
| Framework | NIST 800-53 Revision 5 |
| Severity | ✔ Medium |
Rule Description
Attached Amazon Elastic Block Store (EBS) volumes should have encryption enabled to comply with the security controls outlined in the NIST 800-53 Revision 5 guidelines. This rule helps protect sensitive data stored on EBS volumes by ensuring that they are encrypted at rest.
Troubleshooting Steps (if applicable)
- 1.
Identify unencrypted EBS volumes:
- Check the Amazon EC2 Dashboard, under 'Elastic Block Store,' for any volumes marked as 'Not Encrypted'.
- 2.
Verify encryption settings:
- Select the unencrypted volume and navigate to the 'Encryption' section.
- Verify that encryption is not enabled or set to 'None'.
- 3.
Check permissions:
- Ensure that the IAM role or user associated with the volume has sufficient permissions to enable encryption.
Necessary Code (if applicable)
There is no specific code required for this rule. Enabling encryption for EBS volumes can be done through the AWS Management Console or the AWS Command Line Interface (CLI).
Step-by-Step Guide for Remediation
Method 1: AWS Management Console
- 1.Log in to the AWS Management Console.
- 2.Navigate to the EC2 Dashboard.
- 3.Click on 'Volumes' under 'Elastic Block Store' in the left menu.
- 4.Identify the unencrypted volume that needs to be encrypted.
- 5.Select the volume by clicking on its checkbox.
- 6.In the 'Actions' dropdown menu, click on 'Modify Volume'.
- 7.In the 'Modify Volume' dialog box, scroll down to the 'Encryption' section.
- 8.Click on the 'Encrypt' checkbox.
- 9.Select the appropriate AWS Key Management Service (KMS) key for encryption.
- 10.Click 'Modify' to save the changes.
- 11.Monitor the status of the modification process in the 'Recent Events' section.
Method 2: AWS CLI
- 1.
Open the AWS CLI or a terminal with AWS CLI configured.
- 2.
Run the following command to enable encryption for the desired volume:
aws ec2 modify-volume --volume-id <volume-id> --encryptedReplace
with the actual ID of the volume that needs encryption.<volume-id>Optional: To specify a specific AWS KMS key for encryption, use the
parameter followed by the KMS key ID.--kms-key-id - 3.
Verify the encryption status by viewing the volume details:
aws ec2 describe-volumes --volume-ids <volume-id>Replace
with the ID of the volume you modified.<volume-id>
Additional Notes
- Enabling encryption for an EBS volume will not interrupt its usage or access. It primarily affects the storage layer and ensures data is encrypted at rest.