Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · EC2

EC2.3: Attached EBS volumes are not encrypted at rest

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub EC2.3 check?

EC2.3 fails for every EBS volume currently attached to an instance that reports Encrypted=false. Detached volumes are out of scope (the control assumes attached volumes hold live data), and it evaluates the boolean encryption flag, not which KMS key is used.

Why does EC2.3 matter?

An EBS snapshot from an unencrypted volume is plaintext the moment it leaves your account, and snapshots get shared cross-account or made public by accident constantly. With encryption on, a leaked snapshot is useless without the KMS key. It is also the auditor-visible checkbox for PCI DSS, HIPAA, SOC 2, and ISO 27001 data-at-rest requirements.

How do I fix EC2.3?

  1. Enable account-level default encryption per region first so no new unencrypted volumes are created during the migration.
  2. Inventory attached unencrypted volumes with describe-volumes filtered on Encrypted=false and status=in-use.
  3. Re-encrypt each one: snapshot the volume, copy-snapshot with --encrypted, create a new volume from the encrypted copy, then stop the instance and swap the attachment.
  4. Add the AWS Config rule encrypted-volumes and an SCP denying CreateVolume when Encrypted=false.

Remediation script · bash

# 1. Flip the EBS default across every enabled region (idempotent, free, new volumes only).
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  aws ec2 enable-ebs-encryption-by-default --region "$region" >/dev/null
  echo "$region: EBS default encryption on"
done

# 2. Inventory the immutable storage that needs migrating.
aws efs describe-file-systems \
  --query 'FileSystems[?Encrypted==`false`].[FileSystemId,Name,SizeInBytes.Value]' --output table
aws workspaces describe-workspaces \
  --query 'Workspaces[?RootVolumeEncryptionEnabled==`false`].[WorkspaceId,UserName]' --output table

# 3. Create an encrypted EFS replacement (then migrate data with AWS DataSync, cut over, delete source).
aws efs create-file-system --encrypted \
  --kms-key-id alias/storage-encryption \
  --performance-mode generalPurpose --throughput-mode elastic

# 4. Confirm the default holds, then back it with a Config rule and an SCP.
aws ec2 get-ebs-encryption-by-default --query 'EbsEncryptionByDefault'

Full walkthrough (console steps, edge cases and verification) in the lesson Encrypt EBS and EFS storage at rest.

Is EC2.3 a false positive?

The encrypted flag cannot be flipped in place: there is no modify-volume --encrypted true. Teams who enabled default encryption assume existing volumes were migrated, but only volumes created after the toggle are encrypted, so EC2.3 keeps failing until each old volume is rebuilt.

Full lesson Encrypt EBS and EFS storage at rest Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for EC2 controls ↗ Check your own account for EC2.3 →
Part of the learning path Encrypt everything

More EC2 controls

  • EC2.1 An EBS snapshot is publicly restorable by any account
  • EC2.2 Default security groups still allow traffic
  • EC2.4 Long-stopped instances are abandoned attack surface
  • EC2.6 No VPC flow logs, so there is no network audit trail
  • EC2.7 New EBS volumes are not encrypted by default
  • EC2.8 IMDSv1 lets an SSRF steal instance credentials
  • EC2.9 Instances are directly reachable on public IPv4
  • EC2.10 EC2 API traffic leaves the VPC over the internet
  • EC2.13 SSH (port 22) is open to the entire internet
  • EC2.14 RDP (port 3389) is open to the entire internet
  • EC2.15 Subnets auto-assign public IPs to new instances
  • EC2.17 Instances with multiple ENIs can bridge network boundaries