Encrypt EBS and EFS storage at rest

Encryption at rest on storage is one of the rare controls with essentially zero AWS spend. The AWS-managed key is free, encrypted volumes and snapshots cost the same per GB as unencrypted ones, there is no performance penalty, and the only recurring charge is a customer-managed KMS key at roughly a dollar a month. There is no savings line to chase, which is exactly why it gets deprioritised and exactly why it should not be.

The genuine cost lives in the migration for the immutable storage types. EFS cannot be encrypted in place, so remediation is a create-and-migrate using AWS DataSync; WorkSpaces cannot be encrypted in place, so each non-compliant desktop has to be rebuilt with the user's data migrated across. Both scale with size and complexity, and both get more expensive the longer the resource has been accumulating data and dependencies. The EBS default, by contrast, is a free per-region toggle, so the cheapest version of this whole capability is to flip it everywhere before unencrypted volumes accumulate.

Frame each failing control by data sensitivity, not control count. An unencrypted EFS holding regulated files is a real audit liability that grows with every backup and cross-account copy that inherits the unencrypted state; an unencrypted root volume on a disposable test box is not. Track the count of unencrypted storage resources holding regulated data, trending to zero, each with an owner and a date.

Priya, the finance partner at a healthcare SaaS, sees a SOC 2 readiness scan light up with storage encryption failures across EBS, EFS and WorkSpaces in three accounts, and her instinct is to slow the team down before they treat every finding the same way. She knows this capability splits into two cost shapes that look identical on the report: a free per-region toggle for EBS, and a real migration project for the immutable EFS and WorkSpaces resources that cannot be encrypted in place.

She asks for the inventory split three ways. The EBS default (EC2.7) is on in the home region but off in two newer ones, which is a free, idempotent flip she insists happens immediately so no more unencrypted volumes accumulate while the rest is worked. The unencrypted EFS file systems and WorkSpaces desktops are sorted by data sensitivity: an EFS holding regulated patient files is funded first as a create-and-migrate using AWS DataSync, with the temporary double-running storage and the fractions-of-a-cent-per-GB transfer booked as a distinct one-time line; a root volume on a disposable test box drops to the bottom. The AWS-managed key is free, so she only approves the roughly-a-dollar-a-month customer-managed key where the compliance regime actually demands custody. What was a vague pile of red findings becomes a free fix, a sensitivity-ordered migration backlog and a small number of justified key decisions.

The cost model is asymmetric in a way that is rare for security work. The AWS-managed key is free, encrypted storage is priced identically to unencrypted, and there is no performance penalty, so there is no savings column to populate. Leaving storage unencrypted creates an unbounded tail risk: a leak of a file system holding regulated data carries notification, forensics, legal and reputational costs that dwarf any engineering spend. The right framing is liability discharge, not cost reduction.

The finance role is to make the cheap prevention happen and to fund the migrations by priority. Insist the EBS default is on in every region and protected by an SCP before signing off, because flipping it forward-protects new volumes for free; then attach data sensitivity to each immutable EFS and WorkSpaces finding, fund the regulated-data migrations on a committed timeline, and budget the temporary double-running and DataSync transfer (fractions of a cent per GB) as a distinct one-time line. Track the regulated-data subset, not the raw total.

EBS, EFS and WorkSpaces disks hold the data your cloud workloads write: application data, user uploads, cached credentials, temporary files. This capability checks whether that data is encrypted on disk, and the report shows the gap as a scatter of findings across block storage, file storage and virtual desktops.

The leadership question is whether encryption is enforced by configuration or by human memory. For EBS the answer can be a single account-level default per region, which is free and instant; for EFS and WorkSpaces the fix cannot be retrofitted in place, so each unencrypted resource is a deferred migration project. That asymmetry is the point: prevent new unencrypted storage cheaply at the front door, and treat the legacy immutable resources as an owned, dated backlog.

This is a governance decision, not a budget one. The defensible end state is that every region enforces the EBS default, no file system or desktop holding regulated data is unencrypted, every exception has an owner and a date, and a guardrail such as a Service Control Policy stops the defaults being switched off.

The leadership team learned the asymmetry of this capability from an audit deadline rather than a stolen disk. A scan run ahead of certification showed the EBS default had been flipped on in one region years ago and called done, while two newer regions and a long tail of older file systems and desktops were still unencrypted. The comfortable assumption that AWS encrypts storage by now turned out to be true only for resources created after the defaults shipped, and never auto-applied to the ones that predated them.

The response was to stop chasing individual resource findings and to set one policy with a deliberate split. EBS prevention is free and instant, a per-region default plus a Service Control Policy that stops anyone quietly switching it off, so that became a precondition for signing the item closed. EFS and WorkSpaces cannot be retrofitted in place, so each unencrypted resource holding regulated data became an owned, dated migration rather than an open-ended liability. The leadership signal at the review is no longer the raw finding count but whether the defaults are enforced so the answer cannot degrade without approval, and whether the immutable backlog is shrinking on committed dates.

This capability answers a direct question: if a disk were physically removed, or its snapshot or backup were accessed by the wrong party, would the data be readable? With the storage unencrypted, the answer is yes. Most breaches of stored data trace back to exactly that root cause, and encryption is the control that makes it structurally difficult.

What makes it a leadership item is the split between prevention and cleanup. EBS prevention is free and instant via a per-region default plus an SCP; EFS and WorkSpaces cleanup is a migration project because the resources must be rebuilt. The meaningful decision is not whether to fix the current findings but whether to enforce the defaults so the org never funds this remediation twice. A persistent or recurring count signals provisioning is not governed, which is the pattern worth fixing.