EC2 AMIs Should Be Encrypted

Using Console

Sure, here are the step-by-step instructions to remediate the EC2 AMIs Should Be Encrypted misconfiguration for AWS using AWS console:

Log in to the AWS Management Console.
Navigate to the EC2 dashboard.
In the left-hand navigation panel, click on the “AMIs” option.
Select the AMI that needs to be encrypted.
Click on the “Actions” button and select “Copy AMI”.
In the “Copy AMI” wizard, select the region where the AMI will be copied and check the “Encrypt this image” option.
Select the KMS key that will be used to encrypt the AMI, or create a new one.
Click on the “Copy AMI” button to start the copy process.
Once the copy process is complete, the new encrypted AMI will be available in the selected region.
Repeat this process for all the unencrypted AMIs in your AWS account.

By following these steps, you can remediate the EC2 AMIs Should Be Encrypted misconfiguration for AWS using AWS console.

Using CLI

To remediate the misconfiguration “EC2 AMIs should be encrypted” in AWS using AWS CLI, follow the below steps:

Open the AWS CLI on your local machine or EC2 instance and ensure that you have the necessary permissions to perform the remediation steps.
List all the AMIs that are not encrypted using the following command:

aws ec2 describe-images --filters "Name=block-device-mapping.volume-type,Values=gp2" "Name=state,Values=available" --query 'Images[*].{ID:ImageId,Name:Name,BlockDeviceMappings:BlockDeviceMappings}'

This command will list all the unencrypted AMIs in your AWS account.

Create a new encrypted copy of the unencrypted AMI using the following command:

aws ec2 copy-image --source-image-id ami-xxxxxxxx --source-region us-west-2 --encrypted --region us-west-2

Replace the ami-xxxxxxxx with the ID of the unencrypted AMI that you want to encrypt.

Once the new encrypted AMI is created, deregister the unencrypted AMI using the following command:

aws ec2 deregister-image --image-id ami-xxxxxxxx --region us-west-2

Replace the ami-xxxxxxxx with the ID of the unencrypted AMI that you want to deregister.

Verify that the new encrypted AMI is available and working correctly.
Repeat the above steps for all unencrypted AMIs in your AWS account.

By following these steps, you can remediate the misconfiguration “EC2 AMIs should be encrypted” in AWS using AWS CLI.

Using Python

To remediate the misconfiguration of unencrypted EC2 AMIs in AWS using Python, you can follow the following steps:

Import the required AWS SDKs and libraries:

import boto3

Create an EC2 client object:

ec2 = boto3.client('ec2')

Retrieve a list of all the EC2 instances:

instances = ec2.describe_instances()

Loop through each instance and check if it has any unencrypted AMIs:

for instance in instances['Reservations']:
    for ami in instance['Instances'][0]['BlockDeviceMappings']:
        if not ami.get('Ebs', {}).get('Encrypted', False):
            # If the AMI is not encrypted, remediate it

To remediate an unencrypted AMI, create a new encrypted copy of it:

response = ec2.create_image(
    InstanceId=instance['Instances'][0]['InstanceId'],
    Name='Encrypted AMI',
    Description='Encrypted copy of the original AMI',
    BlockDeviceMappings=[
        {
            'DeviceName': ami['DeviceName'],
            'Ebs': {
                'SnapshotId': ami['Ebs']['SnapshotId'],
                'VolumeType': ami['Ebs']['VolumeType'],
                'VolumeSize': ami['Ebs']['VolumeSize'],
                'Encrypted': True
            }
        }
    ],
    DryRun=False
)

Delete the original unencrypted AMI:

response = ec2.deregister_image(
    ImageId=ami['Ebs']['SnapshotId'],
    DryRun=False
)

Repeat the above steps for each unencrypted AMI found.

Note: Before running the script, make sure that you have the necessary permissions to create and delete EC2 AMIs.

Using Terraform

# Encrypted copy of an existing (unencrypted) AMI
resource "aws_ami_copy" "ENCRYPTED_AMI" {
  name              = "${var.AMI_NAME}-encrypted" # substitute: var.AMI_NAME with the original AMI name or a string literal
  source_image_id   = "UNENCRYPTED_AMI_ID"        # substitute: UNENCRYPTED_AMI_ID with the existing unencrypted AMI ID
  source_region     = "SOURCE_REGION"             # substitute: SOURCE_REGION with the region where the source AMI lives (e.g., "us-east-1")
  encrypted         = true

  # OPTIONAL: use a specific customer-managed KMS key instead of the default EBS key
  # kms_key_id     = "KMS_KEY_ARN"                # substitute: KMS_KEY_ARN with your KMS key ARN
}

# Example: update an EC2 Launch Template to use the new encrypted AMI
resource "aws_launch_template" "EXAMPLE_LT" {
  name_prefix   = "EXAMPLE_LT_PREFIX"            # substitute: EXAMPLE_LT_PREFIX with your launch template name prefix
  image_id      = aws_ami_copy.ENCRYPTED_AMI.id  # now uses the encrypted AMI
  instance_type = "INSTANCE_TYPE"                # substitute: INSTANCE_TYPE, e.g., "t3.micro"

  # ...other launch template arguments...
}

This Terraform configuration creates a new, encrypted copy of the existing AMI, matching the CLI copy-image --encrypted behavior; it does not delete or deregister the original unencrypted AMI (Terraform cannot safely deregister an AMI it does not manage). After you verify workloads with the new AMI, you must manually deregister the old AMI and delete its snapshots in the AWS Console or via CLI as per the warnings.Switching existing EC2 instances, Auto Scaling Groups, or other templates/configurations to use aws_ami_copy.ENCRYPTED_AMI.id will typically cause instance replacement or recreation, which can be disruptive if not coordinated.Verification with terraform plan should show:

a new aws_ami_copy resource being created with encrypted = true
any updated launch templates / configurations changing their image_id from the old unencrypted AMI ID to the new encrypted AMI ID.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

EC2 AMIs Should Be Encrypted

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: