EBS volume should have encryption enabled

What it checks

EBS volume: encryption is not enabled.

Where it applies

Terraform: aws_ebs_volume

CloudFormation: AWS::EC2::Volume

How to fix it

1. Set encrypted = true. EBS encryption cannot be toggled on an existing volume — snapshot the existing volume and restore it with encryption enabled.
2. Enable account-wide default EBS encryption (EC2 console → Settings → Default Encryption) to prevent future unencrypted volumes.

Frameworks

• AWS FSBP EC2.3
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules