In the absence of encryption at rest, compromised data can be easily read. Block devices encryption at rest enhances data protection by safeguarding against unauthorised access to the underlying storage.

Remediation

Enable encryption on block devices. See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/instance#ebs-ephemeral-and-root-block-devices

Metadata

• Severity: informational
• Slug: ec2-unencrypted-block-device

CWEs

• 325: Missing Cryptographic Step

OWASP

• A02:2021: Cryptographic Failures