EC2.7: New EBS volumes are not encrypted by default

What does AWS Security Hub EC2.7 check?

EC2.7 checks the account-level EBS default-encryption toggle and fails in any region where it is off. The setting is per-region and historically defaults to off everywhere, so the control evaluates each enabled region independently: a single account can pass in one region and fail in five others.

Why does EC2.7 matter?

With the default off, every new volume (root volumes from AMIs, launch-template disks, ad-hoc CreateVolume calls) is created unencrypted unless someone remembers to opt in. Each one then seeds unencrypted snapshots, AMIs, and backup chains. It is the auditor's "what stops the next volume being unencrypted?" question, and the honest answer needs to be the regional default, not vigilance.

How do I fix EC2.7?

1. Enumerate every enabled region with describe-regions, then call get-ebs-encryption-by-default against each to find where EC2.7 fails.
2. Decide on the AWS-managed aws/ebs key (free, zero ops) versus a customer-managed CMK if your compliance regime requires key custody.
3. Loop enable-ebs-encryption-by-default across every region (the call is idempotent), then verify true everywhere.
4. Add the AWS Config rule ec2-ebs-encryption-by-default and an SCP denying ec2:DisableEbsEncryptionByDefault so the setting cannot drift back off.

# 1. Flip the EBS default across every enabled region (idempotent, free, new volumes only).
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  aws ec2 enable-ebs-encryption-by-default --region "$region" >/dev/null
  echo "$region: EBS default encryption on"
done

# 2. Inventory the immutable storage that needs migrating.
aws efs describe-file-systems \
  --query 'FileSystems[?Encrypted==`false`].[FileSystemId,Name,SizeInBytes.Value]' --output table
aws workspaces describe-workspaces \
  --query 'Workspaces[?RootVolumeEncryptionEnabled==`false`].[WorkspaceId,UserName]' --output table

# 3. Create an encrypted EFS replacement (then migrate data with AWS DataSync, cut over, delete source).
aws efs create-file-system --encrypted \
  --kms-key-id alias/storage-encryption \
  --performance-mode generalPurpose --throughput-mode elastic

# 4. Confirm the default holds, then back it with a Config rule and an SCP.
aws ec2 get-ebs-encryption-by-default --query 'EbsEncryptionByDefault'