cis-aws-euc-2-3

name	cis-aws-euc-2.3
description	Ensure WorkSpace volumes are encrypted
category	cis-end-user-compute
version	1.2.0
author	cyberstrike-official
tags	["cis","aws","end-user-compute","workspaces","encryption","kms","data-protection"]
cis_id	2.3
cis_benchmark	CIS AWS End User Compute Services Benchmark v1.2.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-euc-2.4"]
prerequisites	[]
severity_boost	{}

Ensure WorkSpace volumes are encrypted (Automated)

Profile Applicability

• Level 1

Description

Encrypt WorkSpaces root volume (C:drive for Windows and root for Amazon Linux) and user volume (D:drive for Windows and /home for Amazon Linux).

Rationale

When you launch a WorkSpace, you can encrypt the root volume and the user volume. This ensures that the data stored at rest for WorkSpaces is encrypted.

Impact

You must encrypt a WorkSpace when it is launched. You cannot create a custom image from an encrypted WorkSpace. You cannot disable encryption once encryption is enabled for a WorkSpace. You must enable to AWS KMS CMK prior to rebuilding/rebooting an encrypted WorkSpace or it becomes unusable.

Audit Procedure

Using AWS Console

1. Login to the WorkSpaces dashboard at https://console.aws.amazon.com/workspaces/
2. In the left pane click WorkSpaces to access the instances listing page
3. Check the storage volume(s) encryption status for each Amazon WorkSpaces instance available in the current AWS region
   • It will be listed in the Volume Encryption column

If the value listed in the Volume Encryption column is Disabled, the selected AWS WorkSpaces instance volumes are not encrypted.

4. Change the AWS region from the navigation bar and repeat step 3 for all other regions

Using AWS CLI

1. Run describe-workspaces command (OSX/Linux/UNIX) using custom query filters to list the IDs of all AWS WorkSpaces instances available within the selected region:

aws workspaces describe-workspaces --region us-east-1 --output table --query 'Workspaces[*].WorkspaceId'

2. The command output should return a table with the requested WorkSpaces IDs:

--------------------
|DescribeWorkspaces|
+------------------+
|  ws-aaabbbccc    |
|  ws-ccceeefff    |
+------------------+

3. Execute again describe-workspaces command (OSX/Linux/UNIX) using the name of the WorkSpaces instance as identifier and custom query filters to get the encryption status for both root and user storage volumes:

aws workspaces describe-workspaces --region us-east-1 --workspace-ids ws-aaabbbccc --query 'Workspaces[*].[RootVolumeEncryptionEnabled,UserVolumeEncryptionEnabled]'

4. The command output should return the encryption status (flag) for both root and user instance volumes (true for enabled, false for disabled):