Volume Encryption Customer Key | Vulnerability Database

EBS volume encryption should use Customer Managed Keys

Encryption using AWS keys provides protection for your EBS volume. To increase control of the encryption and manage factors like rotation use customer managed keys.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Enable encryption using customer managed keys

1
2
3
4
5
6
7
8


Resources:
  GoodExample:
    DeletionPolicy: Snapshot
    Type: AWS::EC2::Volume
    Properties:
      Encrypted: true
      KmsKeyId: alias/volumeEncrypt
      Size: 100

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


Resources:
  MyKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: "2012-10-17"
        Id: key-default-1

  GoodExample:
    DeletionPolicy: Snapshot
    Type: AWS::EC2::Volume
    Properties:
      Encrypted: true
      KmsKeyId: !Ref MyKey
      Size: 100

Enable encryption using customer managed keys

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


resource "aws_kms_key" "ebs_encryption" {
  enable_key_rotation = true
}

resource "aws_ebs_volume" "example" {
  availability_zone = "us-west-2a"
  size              = 40

  kms_key_id = aws_kms_key.ebs_encryption.arn

  tags = {
    Name = "HelloWorld"
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#kms_key_id