Question

A security engineer discovers that several EC2 instances in a production account were launched with unencrypted EBS root and data volumes before an encryption policy was enforced. The engineer has already enabled EBS encryption by default at the account and Region level to protect future volumes. What is the correct approach to bring the EXISTING unencrypted volumes into compliance with the encryption-at-rest requirement while minimizing data loss?

Accepted Answer

Create a snapshot of each unencrypted volume, copy the snapshot with encryption enabled using a KMS key, create new encrypted volumes from the encrypted snapshots, and attach them to the instances.

Answer

Enabling EBS encryption by default automatically encrypts all existing unencrypted volumes during the next instance stop/start cycle, so no further action is needed.

Answer

Use the ModifyVolume API to set the Encrypted attribute to true on each existing volume in place, which encrypts the data without detaching the volume.

Answer

Apply an S3 bucket policy that enforces SSE-KMS to the volumes, since EBS volumes are stored as objects in an underlying S3 bucket.