Policy Packs

guardrails-samples

Ensure that all newly created EBS volumes are automatically encrypted, reducing the risk of unauthorized data access and breaches.

Enforce Default Encryption Is Enabled for New AWS EBS Volumes

main

aws_ec2_account_attribute_encryption_by_default

Define the EBS Encryption by Default settings required for `AWS &gt; EC2 &gt; Account Attributes`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [EBS Encryption by Default](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest) control compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EC2 &gt; Account Attributes &gt; EBS Encryption by Default  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action.&#92;n

ec2AccountAttributesEbsEncryptionByDefault

AWS > EC2 > Account Attributes > EBS Encryption by Default

aws_ec2_account_attribute_encryption_by_default_customer_managed_key

Define the KMS key ID for ebs encryption by default.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [EBS Encryption by Default](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EC2 &gt; Account Attributes &gt; EBS Encryption by Default &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n&#92;nPlease make sure the key defined in the template has required permissions.&#92;n&#92;n```&#92;nexample:&#92;n  alias/aws/ebs&#92;n  ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs&#92;n```&#92;n

ec2AccountAttributesEbsEncryptionByDefaultCustomerManagedKey

AWS > EC2 > Account Attributes > EBS Encryption by Default > Customer Managed Key

turbot_policy_setting.aws_ec2_account_attribute_encryption_by_default

turbot_policy_setting.aws_ec2_account_attribute_encryption_by_default_customer_managed_key

Policy	Setting	Note
AWS > EC2 > Account Attributes > EBS Encryption by Default	Check: AWS managed key or higher
AWS > EC2 > Account Attributes > EBS Encryption by Default > Customer Managed Key	alias/aws/acmekey

Policy Settings