AWS > Ec2 >

Enable Launch Config At Rest Encryption

HIGH
Source
Trivy
ID
AVD-AWS-0008

Launch configuration with unencrypted block device.

Block devices should be encrypted to ensure sensitive data is held securely at rest.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Turn on encryption for all block devices

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
Resources:
  GoodExample:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      BlockDeviceMappings:
        - DeviceName: root
          Ebs:
            Encrypted: true
      ImageId: ami-123456
      InstanceType: t2.small

Turn on encryption for all block devices

1
2
3
4
5
resource "aws_launch_configuration" "good_example" {
  root_block_device {
    encrypted = true
  }
}