Policy: AWS > EC2 > Account Attributes > EBS Encryption by Default > Customer Managed Key

Define the KMS key ID for ebs encryption by default.

Encryption at Rest refers specifically to the encryption of data when written to an underlying storage system. This control determines whether the resource is encrypted at rest, and sets encryption to your desired level.

The EBS Encryption by Default control compares the encryption settings against the encryption policies for the resource (AWS > EC2 > Account Attributes > EBS Encryption by Default > *), raises an alarm, and takes the defined enforcement action

Please make sure the key defined in the template has required permissions.

example: alias/aws/ebs ddc06e04-ce5f-4995-c758-c2b6c510e8fd arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd arn:aws:kms:us-east-1:123456789012:alias/aws/ebs

Targets

This policy targets the following resource types:

AWS > Region

Primary Policy

This policy is used with the following primary policy:

AWS > EC2 > Account Attributes > EBS Encryption by Default

Controls

Setting this policy configures this control:

AWS > EC2 > Account Attributes > EBS Encryption by Default

Policy Packs

This policy setting is used by the following policy packs:

Enforce Default Encryption Is Enabled for New AWS EBS Volumes

Policy Specification

Default template	`{{ $.defaultKey }}`
Default template input	`\| { defaultKey: policy(uri: "aws-kms#/policy/types/keyDefaultCustomerManagedKey") }`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/resourceEncryptionAtRest

Policy Type URI

tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey

GraphQL

query policyType(id: "tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-ec2#/policy/types/ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey"