cis-aws-compute-2-2-3

name	cis-aws-compute-2.2.3
description	Ensure EBS volume snapshots are encrypted
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","ebs","snapshots","encryption"]
cis_id	2.2.3
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.2.1","cis-aws-compute-2.2.2","cis-aws-compute-2.1.2"]
prerequisites	[]
severity_boost	{}

Ensure EBS volume snapshots are encrypted

Description

Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service.

Rationale

Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.

Impact

Existing unencrypted snapshots must be copied with encryption enabled. The original unencrypted snapshots should then be deleted. EBS snapshot volume encryption is configured per snapshot.

Audit Procedure

Using AWS CLI

1. Run describe-snapshots:

aws ec2 describe-snapshots --owner-ids <account number> --filter Name=status,Values=completed --query "Snapshots[*].{ID:SnapshotId}"

2. This will provide a list of all the snapshots associated with that account in the region.

3. For every snapshot listed - Run describe-snapshots:

aws ec2 describe-snapshots --snapshot-id <snap-name> --query "Snapshots[*].{Encrypt:Encrypted}"

4. If the output reads "Encrypt": true, Encryption is set on the snapshot.

If the output reads "Encrypt": false refer to the remediation below.

Note: EBS snapshot volume encryption is configured per snapshot.

Using AWS Console

1. Login to the EC2 console using https://console.aws.amazon.com/ec2/
2. Under Elastic Block Store, click Snapshots.
3. Click the snapshot you want to review.
4. Select the Description tab.
5. Review the Encryption setting.
6. If it reads encrypted you are all set.

If it is set to Not Encrypted refer to the remediation below.

Note: EBS snapshot volume encryption is configured per snapshot.

Expected Result

All snapshots should return "Encrypt": true from the CLI. In the console, all snapshots should show as encrypted in the Encryption field.

Remediation

Using AWS CLI

Using the snapshot ids gathered from the Audit section:

1. Run copy-snapshot: