EC2 root volume is unencrypted because EBS encryption by default is turned off

What it checks

EC2 root volume is unencrypted because EBS encryption by default is turned off

Where it applies

Terraform: aws_instance

CloudFormation: AWS::EC2::Instance

How to fix it

1. Set root_block_device { encrypted = true } on this instance. Encrypting an existing root volume means replacing it, so plan the re-launch.
2. Set enabled = true on aws_ebs_encryption_by_default so new volumes in the Region are encrypted by default. This does not encrypt existing volumes.

Frameworks

• AWS FSBP EC2.7
• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules