Rule: Attached EBS volumes should have encryption enabled

Rule Description

Troubleshooting Steps

2. 1.

   Identify unencrypted EBS volumes: Start by identifying the unencrypted EBS volumes in use. You can do this by checking the configuration settings of each volume or by using AWS CLI commands.

4. 2.

   Check encryption status: Verify the encryption status of each volume by examining its attributes. Ensure that the "encrypted" attribute is set to true.

6. 3.

   Check encryption default settings: Check if the default encryption setting is enabled for your AWS account. If not, it is recommended to enable it for new volumes automatically.

8. 4.

   Modify volume encryption: If you find any unencrypted EBS volumes, you will need to enable encryption for them. This can be done either through the AWS Management Console or via AWS CLI.

AWS CLI Commands

2. 1.

   To enable encryption for a specific volume:

   $ aws ec2 modify-volume --volume-id <volume-id> --encrypted
   

   Replace

   <volume-id>

   with the ID of the volume you want to encrypt.

4. 2.

   To enable encryption for multiple volumes using a script:

   $ volumes=(<volume-id-1> <volume-id-2> <volume-id-3>)
   $ for volume in "${volumes[@]}"; do
   $    aws ec2 modify-volume --volume-id $volume --encrypted
   $ done
   

   Replace

   <volume-id-1>

   ,

   <volume-id-2>

   , etc. with the IDs of the volumes you want to encrypt.

Remediation Steps

2. 1.

   Identify unencrypted volumes: Use the previously mentioned troubleshooting steps to identify which EBS volumes are not encrypted.

4. 2.

   Modify volume encryption: Use the AWS CLI commands mentioned above to enable encryption for each unencrypted volume identified. Execute the commands either manually or by using a script for multiple volumes.

6. 3.

   Verify encryption status: After enabling encryption, use the AWS Management Console or CLI to verify that the "encrypted" attribute for each volume is set to true.

8. 4.

   Automate encryption for new volumes: Set the default encryption option in your AWS account to ensure that all new volumes are encrypted automatically.