Policy Packs

guardrails-samples

Enforcing encryption at rest for AWS EBS volumes is critical to protect sensitive data from unauthorized access and potential breaches.

Enforce Encryption at Rest Is Enabled for AWS EBS Volumes

main

aws_ec2_volume_approved

Determine the action to take when an AWS EC2 volume is not approved based on `AWS &gt; EC2 &gt; Volume &gt; Approved &gt; *` policies.&#92;n&#92;nThe Approved control checks the status of the defined Approved sub-policies for the resource. If the resource is not approved according to any of these policies, this control raises an alarm and takes the defined enforcement action.&#92;n&#92;nFor any enforcement actions that specify `if new`, e.g., `Enforce: Delete unapproved if new`, this control will only take the enforcement actions for resources created within the last 60 minutes.&#92;n&#92;nSee [Approved](https://turbot.com/guardrails/docs/concepts/guardrails/approved) for more information.&#92;n

volumeApproved

AWS > EC2 > Volume > Approved

aws_ec2_volume_approved_encryption_at_rest

Define the Encryption at Rest settings required for `AWS &gt; EC2 &gt; Volume`.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EC2 &gt; Volume &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n

volumeEncryptionAtRest

AWS > EC2 > Volume > Approved > Encryption at Rest

aws_ec2_volume_approved_encryption_at_rest_customer_managed_key

Define the KMS key ID for encryption at rest.&#92;n&#92;nEncryption at Rest refers specifically to the encryption of data when written&#92;nto an underlying storage system. This control determines whether the resource&#92;nis encrypted at rest, and sets encryption to your desired level.&#92;n&#92;nThe [Encryption at Rest](https://turbot.com/guardrails/docs/concepts/guardrails/encryption-at-rest)&#92;ncontrol compares the encryption settings against the encryption policies for the resource&#92;n(`AWS &gt; EC2 &gt; Volume &gt; Encryption at Rest  &gt; *`),&#92;nraises an alarm, and takes the defined enforcement action&#92;n&#92;nPlease make sure the key defined in the template has required permissions.&#92;n&#92;n```&#92;nexample:&#92;n  alias/aws/ebs&#92;n  ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:key/ddc06e04-ce5f-4995-c758-c2b6c510e8fd&#92;n  arn:aws:kms:us-east-1:123456789012:alias/aws/ebs&#92;n```&#92;n

volumeEncryptionAtRestCustomerManagedKey

AWS > EC2 > Volume > Approved > Encryption at Rest > Customer Managed Key

turbot_policy_setting.aws_ec2_volume_approved

turbot_policy_setting.aws_ec2_volume_approved_encryption_at_rest

turbot_policy_setting.aws_ec2_volume_approved_encryption_at_rest_customer_managed_key

Policy	Setting	Note
AWS > EC2 > Volume > Approved	Check: Approved
AWS > EC2 > Volume > Approved > Encryption at Rest	AWS managed key or higher
AWS > EC2 > Volume > Approved > Encryption at Rest > Customer Managed Key	alias/turbot/default

Policy Settings