Question

A CloudOps engineer must continuously detect any EBS volumes in a production account that are created without encryption, so the compliance team receives an alert and a historical record of when each violation occurred. The solution must require minimal custom code and provide a queryable timeline of resource compliance state changes. Which approach best meets these requirements?

Accepted Answer

Enable AWS Config with the managed rule 'encrypted-volumes' and configure an EventBridge rule on Config compliance-change events to notify the compliance team via SNS.

Answer

Create a CloudTrail trail and write a Lambda function triggered on each CreateVolume API call to check the encryption parameter and publish to SNS.

Answer

Enable Amazon Inspector on all EC2 instances to scan attached volumes for encryption weaknesses and route findings to Security Hub.

Answer

Schedule an SSM Automation runbook to run a daily describe-volumes command and email a report of any unencrypted volumes found.