Account-level default EBS encryption should not be disabled

What it checks

Account-level default EBS encryption should not be disabled

Where it applies

Terraform: aws_ebs_encryption_by_default

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Set enabled = true so every new EBS volume in the Region is encrypted by default. This does not encrypt existing unencrypted volumes.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules