WorkSpace should encrypt both its root and user volumes

What it checks

WorkSpace: a storage volume is not encrypted.

Where it applies

Terraform: aws_workspaces_workspace

CloudFormation: AWS::WorkSpaces::Workspace

How to fix it

1. Set root_volume_encryption_enabled = true and user_volume_encryption_enabled = true with a volume_encryption_key. Encryption can only be set at launch, so an existing unencrypted WorkSpace must be recreated.

Frameworks

• SOC 2 CC6.1
• HIPAA 164.312(a)(2)(iv)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules