Need

Secure encryption of confidential information stored in EBS volumes

Context

• Usage of CloudFormation for Infrastructure as Code (IaC)
• Usage of aws-sdk for interacting with Amazon Web Services (AWS) services

Description

Non compliant code

        Resources:
  UnencryptedEBSVolume:
    Type: AWS::EC2::Volume
    Properties:
      AvailabilityZone: us-west-2a
      Size: 40
      Encrypted: false
        
        

The CloudFormation snippet below defines an AWS::EC2::Volume resource that provisions an Amazon EBS volume in the us-west-2a Availability Zone with a size of 40 GiB. However, the volume is not encrypted because the Encrypted property is either omitted or explicitly set to false.

This leads to a security risk because data stored on this volume is not protected at rest. If an attacker gains access to the EBS volume, sensitive information such as system, user, or application data could be exposed.

It is considered best practice to always enable encryption at rest for EBS volumes. AWS provides native support for encryption using AWS KMS-managed keys. Enabling encryption mitigates risks by ensuring that the data is protected even if unauthorized access to the volume occurs.

Steps

• Identify all the EBS volumes in your infrastructure that are not encrypted
• {'Update the CloudFormation templates to include the `Encrypted': 'true` property in each AWS::EC2::Volume resource'}
• Deploy the updated CloudFormation stack to enforce encryption at rest
• Verify through the AWS Console or CLI that all volumes are encrypted

Compliant code

        Resources:
  EncryptedEBSVolume:
    Type: AWS::EC2::Volume
    Properties:
      AvailabilityZone: us-west-2a
      Size: 40
      Encrypted: true
        
        

The following CloudFormation snippet shows the corrected version of the previous insecure configuration. The Encrypted property is now set to true, ensuring that data stored on the EBS volume is protected at rest.

The volume will now be encrypted using the default AWS managed key (or a custom key, if specified). This significantly reduces the risk of unauthorized access to sensitive information in case of data exposure.

No other properties were modified; the AvailabilityZone and Size remain as originally configured.

References

• 407. Non-encrypted confidential information - EBS Volumes