Policy Setting: AWS > EC2 > Instance > Approved > Root Volume Encryption at Rest

resource "turbot_policy_setting" "aws_ec2_root_volume_encryption_at_rest" {
  resource = turbot_policy_pack.main.id
  type     = "tmod:@turbot/aws-ec2#/policy/types/rootVolumeEncryptionAtRest"
  note     = "AWS CIS v3.0.0 - Control: 2.2.1"
  value    = "AWS managed key or higher"
}