Enable Volume Encryption

Using Console

Below are step‑by‑step instructions using the AWS Management Console to ensure EC2 volumes are encrypted. There are two parts:

Enable default EBS encryption for all new volumes
Encrypt existing unencrypted volumes

1. Enable default EBS volume encryption (for all new volumes)

Sign in to the AWS Management Console and go to EC2.
In the left navigation pane, under Elastic Block Store, choose Settings (or EBS encryption depending on console version).
Click Manage (or Edit).
Check Enable encryption by default.
(Optional) In AWS KMS key, choose a customer‑managed KMS key, or leave the default aws/ebs.
Click Save changes.

All new EBS volumes and snapshots created in this Region are now encrypted.

2. Encrypt an existing unencrypted EBS volume

You cannot turn encryption on directly for an existing volume; you must migrate data to a new encrypted volume.

2.1 Identify the unencrypted volume

In the EC2 console, in the left pane choose Volumes.
Add the Encrypted column (gear icon ▸ check Encrypted).
Find volumes where Encrypted = False that you want to remediate.

2.2 Create a snapshot of the unencrypted volume

Select the unencrypted volume.
Click Actions ▸ Create snapshot.
Enter a Description (e.g., snapshot-before-encryption-vol-<id>).
Click Create snapshot.
Go to Snapshots and wait until the snapshot’s Status is completed.

2.3 Copy the snapshot and enable encryption

In Snapshots, select the snapshot you just created.
Click Actions ▸ Copy snapshot.
Keep the same Region (or choose another if needed).
Under Encryption, check Encrypt this snapshot.
Choose the KMS key (default aws/ebs or your CMK).
Click Copy snapshot.
Wait until the copied snapshot’s Status is completed.

2.4 Create an encrypted volume from the encrypted snapshot

In Snapshots, select the encrypted snapshot (the copy).
Click Actions ▸ Create volume.
Choose:
- Availability Zone: must match the AZ of the original volume’s attached instance (e.g., us-east-1a).
- Volume type and Size: match the original volume (or larger).
Ensure Encrypted is Yes and the correct KMS key is selected.
Click Create volume.
Wait until the new volume’s State is available.

2.5 Detach the old volume and attach the new encrypted volume

To avoid data loss, perform this during a maintenance window and back up first.

In EC2 ▸ Instances, select the instance using the original unencrypted volume.
Stop application services that write to the disk, then stop the instance:
- Instance state ▸ Stop instance and confirm.
After the instance is stopped, go to Volumes.
Select the old unencrypted volume.
Click Actions ▸ Detach volume and confirm.
Note its Device name (e.g., /dev/xvda, /dev/sdf) for the next step.
Select the new encrypted volume.
Click Actions ▸ Attach volume.
Choose the Instance and specify the Device name to match the old one.
Click Attach volume.

2.6 Start the instance and validate

Go back to Instances, select the instance.
Click Instance state ▸ Start instance.
Once running, log into the instance and validate:
- Volumes and file systems mount correctly.
- Applications run as expected.
In Volumes, confirm the attached volume shows Encrypted = True.

2.7 (Optional) Clean up old unencrypted resources

After you’ve confirmed everything works and backups are in place:

In Volumes, select the old unencrypted volume.
Click Actions ▸ Delete volume and confirm.
In Snapshots, delete the original unencrypted snapshot if no longer needed.

You can repeat steps 2.1–2.7 for each unencrypted EBS volume you need to remediate.

Using CLI

Below are the key ways to remediate “Enable Volume Encryption” for AWS EC2 using the AWS CLI.

1. Enable Default EBS Encryption (Global Setting)

This ensures all new EBS volumes and snapshots created in this region are encrypted by default.

1.1. Check current default encryption status

aws ec2 get-ebs-encryption-by-default

Look for "EbsEncryptionByDefault": false or true.

1.2. Enable default EBS encryption

aws ec2 enable-ebs-encryption-by-default

(Optionally specify a custom KMS key)

aws ec2 modify-ebs-default-kms-key-id \
  --kms-key-id arn:aws:kms:<region>:<account-id>:key/<key-id>

2. Encrypt an Existing Unencrypted EBS Volume

Existing volumes cannot be encrypted in-place; you must:

Create an encrypted snapshot from it,
Create a new encrypted volume from that snapshot,
Stop the instance, swap volumes, and start the instance.

Assume:

Region: us-east-1
Instance ID: i-0123456789abcdef0
Old volume ID: vol-0123456789abcdef0
Device name: /dev/xvda (root volume example)

2.1. Create a snapshot of the existing unencrypted volume

aws ec2 create-snapshot \
  --region us-east-1 \
  --volume-id vol-0123456789abcdef0 \
  --description "Snapshot before encryption"

Note the SnapshotId returned, e.g. snap-0123456789abcdef0.Wait for snapshot completion:

aws ec2 describe-snapshots \
  --region us-east-1 \
  --snapshot-ids snap-0123456789abcdef0 \
  --query "Snapshots[0].State"

Continue when state is completed.

2.2. Create an encrypted copy of the snapshot

aws ec2 copy-snapshot \
  --region us-east-1 \
  --source-region us-east-1 \
  --source-snapshot-id snap-0123456789abcdef0 \
  --encrypted \
  --description "Encrypted copy of snapshot"

Optionally specify a KMS key:

aws ec2 copy-snapshot \
  --region us-east-1 \
  --source-region us-east-1 \
  --source-snapshot-id snap-0123456789abcdef0 \
  --encrypted \
  --kms-key-id arn:aws:kms:us-east-1:<account-id>:key/<key-id> \
  --description "Encrypted copy of snapshot"

Note the new SnapshotId (e.g. snap-0encrypted123456789), and wait until it’s completed as above.

2.3. Create a new encrypted volume from the encrypted snapshot

Get the Availability Zone of the current volume:

aws ec2 describe-volumes \
  --region us-east-1 \
  --volume-ids vol-0123456789abcdef0 \
  --query "Volumes[0].AvailabilityZone" \
  --output text

Assume it returns us-east-1a.Create the encrypted volume:

aws ec2 create-volume \
  --region us-east-1 \
  --availability-zone us-east-1a \
  --snapshot-id snap-0encrypted123456789 \
  --volume-type gp3

Note the new VolumeId (e.g. vol-0encrypted123456789) and wait until state is available:

aws ec2 describe-volumes \
  --region us-east-1 \
  --volume-ids vol-0encrypted123456789 \
  --query "Volumes[0].State"

2.4. Stop the instance

aws ec2 stop-instances \
  --region us-east-1 \
  --instance-ids i-0123456789abcdef0

Wait until it’s stopped:

aws ec2 wait instance-stopped \
  --region us-east-1 \
  --instance-ids i-0123456789abcdef0

2.5. Detach the old (unencrypted) volume

aws ec2 detach-volume \
  --region us-east-1 \
  --volume-id vol-0123456789abcdef0

Wait for it to become available.

2.6. Attach the new encrypted volume

Attach using the same device name as before (e.g. /dev/xvda):

aws ec2 attach-volume \
  --region us-east-1 \
  --volume-id vol-0encrypted123456789 \
  --instance-id i-0123456789abcdef0 \
  --device /dev/xvda

2.7. Start the instance

aws ec2 start-instances \
  --region us-east-1 \
  --instance-ids i-0123456789abcdef0

3. Verify the Volume Is Encrypted

aws ec2 describe-volumes \
  --region us-east-1 \
  --volume-ids vol-0encrypted123456789 \
  --query "Volumes[0].{Encrypted:Encrypted,KmsKeyId:KmsKeyId}"

You should see "Encrypted": true.

If you share:

region,
instance ID,
which volume(s) (root vs data), I can tailor exact command sequences for each.

Using Python

Below are concrete remediation steps and a Python (boto3) example to enable EBS volume encryption for EC2 in AWS.

1. Prerequisites

Install and configure AWS CLI or set environment variables so boto3 can authenticate:

pip install boto3
aws configure  # or set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_REGION

Make sure your IAM principal has:
- ec2:DescribeVolumes
- ec2:ModifyVolume
- ec2:DescribeInstances
- ec2:EnableEbsEncryptionByDefault (if you also want to turn on default encryption)
- Permissions to use the chosen KMS key (kms:Encrypt, kms:Decrypt, etc.).

2. One-time: Enable EBS encryption by default (recommended)

This makes all new EBS volumes encrypted automatically.

import boto3

region = "us-east-1"
ec2 = boto3.client("ec2", region_name=region)

response = ec2.enable_ebs_encryption_by_default()
print("EBS encryption by default enabled:", response["EbsEncryptionByDefault"])

3. Encrypt existing unencrypted EBS volumes in-place

AWS now supports converting an unencrypted EBS volume to encrypted using modify_volume.

High-level steps

List all volumes (optionally filter by instance, tags, region).
For each volume:
- Skip if Encrypted is True.
- Call ModifyVolume with Encrypted=True and optional KmsKeyId.
- Poll DescribeVolumesModifications until the modification state is completed or optimizing.

Important notes

This operation is online: the instance can remain running.
Performance may be slightly impacted while the volume is being optimized.
Choose a CMK if your security policy requires customer-managed keys; otherwise, AWS-managed key is fine.

4. Example Python script (boto3)

This example:

Targets a specific region.
Optionally targets a specific instance by ID (or all volumes in the region).
Encrypts all unencrypted volumes with the default EBS KMS key (or a specific CMK if provided).

import time
import boto3

REGION = "us-east-1"
INSTANCE_ID = None  # set to an EC2 instance ID like "i-0123456789abcdef0" or leave as None for all volumes in the region
KMS_KEY_ID = None   # e.g. "arn:aws:kms:us-east-1:123456789012:key/abcd-..." or leave None to use AWS-managed key

ec2 = boto3.client("ec2", region_name=REGION)


def get_target_volumes(instance_id=None):
    filters = []
    if instance_id:
        filters.append({"Name": "attachment.instance-id", "Values": [instance_id]})

    paginator = ec2.get_paginator("describe_volumes")
    volumes = []
    for page in paginator.paginate(Filters=filters):
        for vol in page["Volumes"]:
            if not vol["Encrypted"]:
                volumes.append(vol)
    return volumes


def encrypt_volume(volume_id, kms_key_id=None):
    params = {
        "VolumeId": volume_id,
        "Encrypted": True,
    }
    if kms_key_id:
        params["KmsKeyId"] = kms_key_id

    print(f"Starting encryption for volume {volume_id} ...")
    ec2.modify_volume(**params)


def wait_for_encryption(volume_id, timeout=3600, poll_interval=15):
    """Wait until volume modification is completed or optimizing."""
    start = time.time()
    while True:
        resp = ec2.describe_volumes_modifications(VolumeIds=[volume_id])
        mods = resp.get("VolumesModifications", [])
        if not mods:
            print(f"No modification record for volume {volume_id}, assuming done.")
            return

        mod = mods[0]
        state = mod["ModificationState"]
        progress = mod.get("Progress", 0)
        print(f"Volume {volume_id} state={state}, progress={progress}%")

        if state in ("completed", "optimizing"):
            print(f"Encryption finished/optimizing for volume {volume_id}.")
            return

        if time.time() - start > timeout:
            raise TimeoutError(f"Timeout waiting for volume {volume_id} encryption")

        time.sleep(poll_interval)


def main():
    # 1. Enable EBS encryption by default for new volumes (optional but recommended)
    try:
        resp = ec2.enable_ebs_encryption_by_default()
        print("EBS encryption by default:", resp["EbsEncryptionByDefault"])
    except ec2.exceptions.ClientError as e:
        print("Could not enable EBS encryption by default (check perms):", e)

    # 2. Find all unencrypted volumes (optionally only for one instance)
    vols = get_target_volumes(INSTANCE_ID)
    if not vols:
        print("No unencrypted volumes found.")
        return

    print(f"Found {len(vols)} unencrypted volumes.")
    for v in vols:
        vol_id = v["VolumeId"]
        print(f"Processing volume {vol_id} (size={v['Size']}GiB, type={v['VolumeType']})")

        # 3. Start encryption
        try:
            encrypt_volume(vol_id, KMS_KEY_ID)
        except ec2.exceptions.ClientError as e:
            print(f"Failed to start encryption for {vol_id}: {e}")
            continue

        # 4. Wait until encryption is done/optimizing
        try:
            wait_for_encryption(vol_id)
        except Exception as e:
            print(f"Error waiting for encryption of {vol_id}: {e}")


if __name__ == "__main__":
    main()

5. What to adjust for your environment

Set REGION to your AWS region.
Set INSTANCE_ID if you only want to remediate a single instance.
Set KMS_KEY_ID to a CMK if required by policy.
Optionally narrow scopes using tags via Filters in describe_volumes.

This is sufficient to remediate the “Enable Volume Encryption” finding for EC2 EBS volumes using Python on AWS.

Using Terraform

# Encrypt all new EBS volumes in this account/region by default
resource "aws_ebs_encryption_by_default" "default" {
  enabled = true
}

# (Optional) Use a specific KMS key instead of aws/ebs
# Replace KMS_KEY_ARN with your KMS key ARN (e.g. arn:aws:kms:us-east-1:123456789012:key/abc-...)
resource "aws_ebs_default_kms_key" "default" {
  key_arn = "KMS_KEY_ARN"
}

# Example: encrypted standalone EBS volume
# NOTE: Turning on `encrypted` for an existing, unmanaged-by-Terraform volume
# requires creating a new encrypted volume and migrating data; Terraform can’t
# flip encryption in-place.
resource "aws_ebs_volume" "encrypted_data" {
  availability_zone = "AVAILABILITY_ZONE" # e.g. us-east-1a
  size              = 100

  encrypted = true
  kms_key_id = aws_ebs_default_kms_key.default.key_arn # or omit to use aws/ebs
  tags = {
    Name = "ENCRYPTED_VOLUME_NAME"
  }
}

# Example: encrypt the root volume of a new EC2 instance via a launch template
resource "aws_launch_template" "encrypted" {
  name_prefix   = "ENCRYPTED_LT_NAME_PREFIX"
  image_id      = "AMI_ID"
  instance_type = "t3.micro"

  block_device_mappings {
    device_name = "/dev/xvda"

    ebs {
      volume_size = 20
      encrypted   = true
      kms_key_id  = aws_ebs_default_kms_key.default.key_arn
      volume_type = "gp3"
    }
  }
}

Enabling aws_ebs_encryption_by_default is in-place; adding encrypted = true (and optionally kms_key_id) on aws_ebs_volume or launch templates causes new encrypted volumes to be created instead of unencrypted ones. For already-existing unencrypted volumes, Terraform must create new encrypted volumes and you must handle cutover; encryption cannot be toggled in-place.After remediation, terraform plan should show:

aws_ebs_encryption_by_default.default created with enabled = true.
(Optional) aws_ebs_default_kms_key.default created with your KMS key ARN.
Any aws_ebs_volume or launch template changes adding encrypted = true (and kms_key_id), with volume resources marked for replacement where applicable.

​More Info:

​Risk Level

​Address

​Compliance Standards

​Remediation

​Using AWS Console

​Triage and Remediation

​Remediation

​1. Enable default EBS volume encryption (for all new volumes)

​2. Encrypt an existing unencrypted EBS volume

​2.1 Identify the unencrypted volume

​2.2 Create a snapshot of the unencrypted volume

​2.3 Copy the snapshot and enable encryption

​2.4 Create an encrypted volume from the encrypted snapshot

​2.5 Detach the old volume and attach the new encrypted volume

​2.6 Start the instance and validate

​2.7 (Optional) Clean up old unencrypted resources

​1. Enable Default EBS Encryption (Global Setting)

​1.1. Check current default encryption status

​1.2. Enable default EBS encryption

​2. Encrypt an Existing Unencrypted EBS Volume

​2.1. Create a snapshot of the existing unencrypted volume

​2.2. Create an encrypted copy of the snapshot

​2.3. Create a new encrypted volume from the encrypted snapshot

​2.4. Stop the instance

​2.5. Detach the old (unencrypted) volume

​2.6. Attach the new encrypted volume

​2.7. Start the instance

​3. Verify the Volume Is Encrypted

​1. Prerequisites

​2. One-time: Enable EBS encryption by default (recommended)

​3. Encrypt existing unencrypted EBS volumes in-place

​High-level steps

​Important notes

​4. Example Python script (boto3)

​5. What to adjust for your environment

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Remediation

Using AWS Console

Triage and Remediation