HIGH
Source
Trivy
ID
AVD-AWS-0026

EBS volumes must be encrypted

By enabling encryption on EBS volumes you protect the volume, the disk I/O and any derived snapshots from compromise if intercepted.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption of EBS volumes

1
2
3
4
5
6
7
8
Resources:
  GoodExample:
    DeletionPolicy: Snapshot
    Type: AWS::EC2::Volume
    Properties:
      Encrypted: true
      KmsKeyId: alias/volumeEncrypt
      Size: 100

Enable encryption of EBS volumes

1
2
3
4
5
6
7
8
9
resource "aws_ebs_volume" "good_example" {
  availability_zone = "us-west-2a"
  size              = 40

  tags = {
    Name = "HelloWorld"
  }
  encrypted = true
}