EC2 instance should have EBS root volume encryption enabled

What it checks

EC2 instance: root EBS volume is not encrypted.

Where it applies

Terraform: aws_instance

CloudFormation: AWS::EC2::Instance

How to fix it

1. Set root_block_device { encrypted = true } and re-launch, or enable account-wide default EBS encryption

Frameworks

• AWS FSBP EC2.3
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules