# EBS Volume Not Encrypted

> An unencrypted EBS volume cannot be encrypted in place. Fixing it requires a snapshot, a new encrypted volume, and a detach-attach cycle with downtime. ZopNight flags these as high severity because the remediation gets harder the longer the volume lives and grows.

Source: https://zop.dev/integrations/aws/recommendations/ebs-volume-not-encrypted
Updated: 2026-08-19

---

## Why this is high severity but costs nothing

There is no dollar saving here, since encryption is free on EBS. It is rated `high` because of the
remediation path, not the exposure.

An EBS volume **cannot be encrypted in place**. There is no toggle. Fixing one means:

1. Snapshot the unencrypted volume
2. Create a new volume from that snapshot with encryption enabled
3. Stop the instance, detach the old volume, attach the new one, start it

That is real downtime, and the snapshot-and-copy step scales with volume size. A 100 GB volume
is an inconvenience; a 4 TB one is a maintenance window you have to schedule.

## The fix that matters most is the account setting

Remediating individual volumes is treating symptoms. Enable **EBS encryption by default** at the
account level, per region, and every volume created afterwards is encrypted with no workflow
change:

```bash
aws ec2 enable-ebs-encryption-by-default --region us-east-1
aws ec2 get-ebs-encryption-by-default --region us-east-1
```

It is a per-region setting, which is the usual reason a fleet is encrypted in one region and not
another. Doing this first means the list stops growing while you work through the backlog.

## Listing volumes with encrypted set to false

```bash
aws ec2 describe-volumes   --filters Name=encrypted,Values=false   --query 'Volumes[].[VolumeId,Size,State,Attachments[0].InstanceId]' --output table
```

## Sequencing the backlog

Do detached volumes first: no downtime, and some of them are orphans you can delete outright
rather than encrypt. Then the smallest attached ones, to build confidence in the procedure
before you take a window for the large ones.