Cis AWS Compute 2.2.3

Ensure EBS volume snapshots are encrypted

Description

Elastic Compute Cloud (EC2) supports encryption at rest when using the Elastic Block Store (EBS) service.

Rationale

Encrypting data at rest reduces the likelihood that it is unintentionally exposed and can nullify the impact of disclosure if the encryption remains unbroken.

Impact

Existing unencrypted snapshots must be copied with encryption enabled. The original unencrypted snapshots should then be deleted. EBS snapshot volume encryption is configured per snapshot.

Audit Procedure

Using AWS CLI

1. Run describe-snapshots:

aws ec2 describe-snapshots --owner-ids <account number> --filter Name=status,Values=completed --query "Snapshots[*].{ID:SnapshotId}"

2. This will provide a list of all the snapshots associated with that account in the region.

3. For every snapshot listed - Run describe-snapshots:

aws ec2 describe-snapshots --snapshot-id <snap-name> --query "Snapshots[*].{Encrypt:Encrypted}"

4. If the output reads "Encrypt": true, Encryption is set on the snapshot.

If the output reads "Encrypt": false refer to the remediation below.

Note: EBS snapshot volume encryption is configured per snapshot.

Using AWS Console

1. Login to the EC2 console using https://console.aws.amazon.com/ec2/
2. Under Elastic Block Store, click Snapshots.
3. Click the snapshot you want to review.
4. Select the Description tab.
5. Review the Encryption setting.
6. If it reads encrypted you are all set.

If it is set to Not Encrypted refer to the remediation below.

Note: EBS snapshot volume encryption is configured per snapshot.

Expected Result

All snapshots should return "Encrypt": true from the CLI. In the console, all snapshots should show as encrypted in the Encryption field.

Remediation

Using AWS CLI

Using the snapshot ids gathered from the Audit section:

1. Run copy-snapshot:

aws ec2 copy-snapshot --source-region <region> --source-snapshot-id <snap-id> --description "Name of the new snapshot" --encrypted

2. This will copy the existing unencrypted snapshot and set it to encrypted. The output will show the new SnapshotId.

3. Run describe-snapshots:

aws ec2 describe-snapshots --owner-ids <account id> --filter Name=status,Values=completed --query "Snapshots[*].{ID:SnapshotId}"

Once the new Snapshot shows in the list confirm encryption is set:

4. Run describe-snapshots:

aws ec2 describe-snapshots --snapshot-id <snap-name> --query "Snapshots[*].{Encrypt:Encrypted}"

5. Repeat steps 1-4 for the snapshots that need to be encrypted.

Delete snapshots that are no longer needed:

6. Run delete-snapshot:

aws ec2 delete-snapshot --snapshot-id <snap-name>

7. Repeat for all unencrypted snapshots that have been copied and encrypted.

Note: EBS snapshot volume encryption is configured per snapshot.

Using AWS Console

1. Login to the EC2 console using https://console.aws.amazon.com/ec2/
2. Under Elastic Block Store, click Snapshots.
3. Select the snapshot you want to encrypt.
4. Click on Actions select Copy.

Confirm `Snapshot ID`
Set the `Destination Region`
Update the `Description`
Select the check box for `Encryption`

5. Check the box for Encrypt this snapshot.
6. Set the Master Key.
7. Click on Copy.
8. Repeat steps 3-7 for the snapshots that need to be encrypted.
9. Delete any of the unencrypted snapshots that are not longer needed.

Note: EBS snapshot volume encryption is configured per snapshot.

Default Value

By default, EBS snapshots are not encrypted. Encryption must be explicitly enabled when creating or copying snapshots.

References

1. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html
2. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-snapshots.html
3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-snapshot.html
4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-snapshot.html

CIS Controls

Profile

Level 1 | Automated