EBS volumes without encryption at rest
What does ZopNight detect here?
An unencrypted EBS volume cannot be encrypted in place. Fixing it requires a snapshot, a new encrypted volume, and a detach-attach cycle with downtime. ZopNight flags these as high severity because the remediation gets harder the longer the volume lives and grows.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-172 |
| Category | compliance |
| Severity | high |
| Metric | none — pure configuration read |
| Source | ebs_unencrypted.go |
Where it applies
Why this is high severity but costs nothing
There is no dollar saving here, since encryption is free on EBS. It is rated high because of the
remediation path, not the exposure.
An EBS volume cannot be encrypted in place. There is no toggle. Fixing one means:
- Snapshot the unencrypted volume
- Create a new volume from that snapshot with encryption enabled
- Stop the instance, detach the old volume, attach the new one, start it
That is real downtime, and the snapshot-and-copy step scales with volume size. A 100 GB volume is an inconvenience; a 4 TB one is a maintenance window you have to schedule.
The fix that matters most is the account setting
Remediating individual volumes is treating symptoms. Enable EBS encryption by default at the account level, per region, and every volume created afterwards is encrypted with no workflow change:
aws ec2 enable-ebs-encryption-by-default --region us-east-1aws ec2 get-ebs-encryption-by-default --region us-east-1It is a per-region setting, which is the usual reason a fleet is encrypted in one region and not another. Doing this first means the list stops growing while you work through the backlog.
Listing volumes with encrypted set to false
aws ec2 describe-volumes --filters Name=encrypted,Values=false --query 'Volumes[].[VolumeId,Size,State,Attachments[0].InstanceId]' --output tableSequencing the backlog
Do detached volumes first: no downtime, and some of them are orphans you can delete outright rather than encrypt. Then the smallest attached ones, to build confidence in the procedure before you take a window for the large ones.