cis-aws-compute-2-1-2

name	cis-aws-compute-2.1.2
description	Ensure Amazon Machine Images (AMIs) are encrypted
category	cis-compute
version	1.1.0
author	cyberstrike-official
tags	["cis","aws","compute","ec2","ami","encryption","ebs"]
cis_id	2.1.2
cis_benchmark	CIS AWS Compute Services Benchmark v1.1.0
tech_stack	["aws"]
cwe_ids	[]
chains_with	["cis-aws-compute-2.1.1","cis-aws-compute-2.2.1","cis-aws-compute-2.2.3"]
prerequisites	[]
severity_boost	{}

Ensure Amazon Machine Images (AMIs) are encrypted

Description

Amazon Machine Images should utilize EBS Encrypted snapshots.

Rationale

AMIs backed by EBS snapshots should use EBS encryption. Snapshot volumes can be encrypted and attached to an AMI.

Impact

Encrypting AMIs may add slight overhead to instance launch times and requires KMS key management. Existing unencrypted AMIs must be copied with encryption enabled and old ones deregistered.

Audit Procedure

Using AWS CLI

1. Run the aws ec2 describe-images command to find unencrypted AMIs:

aws ec2 describe-images --region us-east-1 --owner self --filter "Name=block-device-mapping.encrypted,Values=false" --query "Images[*].[ImageId]"

2. If this produces a list of AMI's make note as these are not encrypted, then refer to the remediation below.

Using AWS Console

1. Login to the IAM console at https://console.aws.amazon.com/ec2/.
2. In the left pane click Instances, click AMIs.
3. In the Details tab.
4. Review the 'Block Devices'.
5. Confirm that it ends with encrypted.

If it doesn't end with encrypted, refer to the remediation below.

Expected Result

The CLI command should return an empty list, indicating all AMIs use encrypted EBS snapshots. In the console, all AMI block devices should show as encrypted.

Remediation

Using AWS CLI

1. Run the aws ec2 copy-image command to copy AMI with encrypted block device:

aws ec2 copy-image --name <New_AMI_Name> --source-image-id <Image-ID> --source-region <region> --encrypted

2. Run aws ec2 deregister-image to deregister older AMIs:

aws ec2 deregister-image --image-id <Image-ID>

Using AWS Console

1. Login to the EC2 console at https://console.aws.amazon.com/ec2/.
2. In the left pane click on AMIs.
3. Select the AMI that does not comply to the encryption policy.
4. Click on Actions.
5. Click on Copy AMI.