Enable EBS encryption by default

To guarantee that every EBS volume in an account is encrypted — including volumes restored from snapshots that were themselves unencrypted — enable EBS encryption by default for the Region.

What the setting does

Encryption by default is an account-level, Region-level setting. Once it is on:

• Every new EBS volume created in that Region is encrypted, whichever user, role or service creates it.
• A volume restored from an unencrypted snapshot is encrypted on restore.
• New snapshots taken of encrypted volumes are encrypted.

Because the setting sits at the Region level, it does not depend on anyone remembering to tick a box in a launch wizard, a Terraform module or a CloudFormation template. That is the whole point: a per-volume control is a control you will eventually forget to apply, and the gap will not be visible until an audit finds it.

What it does not do

• It is per Region. Enable it in every Region you use, and include it in the baseline you apply to new accounts.
• It does not retroactively encrypt volumes that already exist. Existing unencrypted volumes have to be migrated: snapshot, copy the snapshot with encryption enabled, and create a new volume from the encrypted copy.
• It does not choose a key for you beyond the default. The setting uses the AWS managed key for EBS unless you nominate a customer managed KMS key, which you should do wherever key policy, rotation schedule or cross-account grants matter.

Enforcing it

Enable the setting in every account and Region, then verify it rather than trusting it: AWS Config has a managed rule for encrypted volumes, and a service control policy can deny ec2:CreateVolume where ec2:Encrypted is false, which closes the same gap from the other direction.