How to Enforce EBS Encryption by Default in an AWS Region?

Enforcing Amazon Elastic Block Store encryption by default is a native regional account setting in Amazon EC2 that automatically encrypts all newly created EBS volumes and snapshot copies without requiring explicit encryption parameters during creation. When you enable this setting in a specific AWS Region, Amazon EC2 ensures that every new volume launched in that region is encrypted using either the AWS managed key for EBS or a customer managed AWS Key Management Service key that you specify as the regional default. This article covers how default EBS encryption works, how to enable and configure it using the AWS Management Console, AWS CLI, and Terraform, and how to use organizational guardrails to prevent users from disabling the setting.

How EBS Encryption by Default Works

Amazon EBS encryption by default applies to the specific AWS account and AWS Region where it is configured. Because it is a regional setting, you must enable it individually in every region where your workloads operate.

Once enabled, the setting governs the following behaviors:

  • New Blank Volumes: Any new EBS volume created in the region is automatically encrypted, even if the Encrypted parameter is omitted or set to false in the API request (unless overridden by specific internal migration flows, though standard creation APIs enforce encryption).
  • Volumes Created from Unencrypted Snapshots: Launching an EC2 instance or creating a volume from an unencrypted snapshot (including public AMI snapshots) automatically results in an encrypted volume on the fly.
  • Copied Snapshots: Copying an unencrypted snapshot within or into the region automatically encrypts the resulting snapshot copy.
  • Existing Resources: Enabling default encryption does not retroactively encrypt existing unencrypted EBS volumes or existing snapshots.

Default KMS Key Selection

When you enable encryption by default, AWS uses the default KMS key configured for EBS in that region (alias/aws/ebs) unless you specify a custom default KMS key. You can change the default KMS key to a symmetric customer managed KMS key when you need custom key rotation policies, cross-account snapshot sharing capabilities, or fine-grained KMS key policies.

Enabling Default EBS Encryption via the AWS Management Console

To configure default EBS encryption for a region using the AWS Management Console:

  1. Sign in to the AWS Management Console and open the Amazon EC2 console.
  2. In the top navigation bar, select the AWS Region where you want to enforce encryption.
  3. In the navigation pane, under Account attributes (or in the EC2 Dashboard under Account attributes), choose EBS encryption (or Data protection and security).
  4. Click Manage.
  5. Select the checkbox for Always encrypt new EBS volumes.
  6. For Default encryption key, select either the aws/ebs default key or choose a Customer managed key from the dropdown list.
  7. Click Update EBS encryption to apply the setting.

Enabling Default EBS Encryption via the AWS CLI

You can automate and verify the configuration across regions using the AWS Command Line Interface (AWS CLI).

1. Check Current Encryption Status

Run the get-ebs-encryption-by-default command to verify whether default encryption is currently active in the target region:

aws ec2 get-ebs-encryption-by-default --region us-east-1

2. Enable Encryption by Default

Run the enable-ebs-encryption-by-default command to enforce encryption for all new volumes and snapshot copies in the specified region:

aws ec2 enable-ebs-encryption-by-default --region us-east-1

3. Configure a Custom Default KMS Key (Optional)

If you want to use a customer managed KMS key instead of the AWS managed key (alias/aws/ebs), use the modify-ebs-default-kms-key-id command:

aws ec2 modify-ebs-default-kms-key-id \
  --kms-key-id arn:aws:kms:us-east-1:123456789012:key/abcd1234-5678-90ef-ghij-klmnopqrstuv \
  --region us-east-1

4. Enable Across All Active Regions with a Script

Because the setting is regional, you can loop through all enabled regions in your account to enforce encryption globally:

for region in $(aws ec2 describe-regions --filters "Name=opt-in-status,Values=opt-in-not-required,opted-in" --query "Regions[].RegionName" --output text); do
  echo "Enabling EBS encryption by default in $region"
  aws ec2 enable-ebs-encryption-by-default --region "$region"
done

Enforcing Default EBS Encryption with Terraform

If you manage your cloud infrastructure as code using Terraform, use the aws_ebs_encryption_by_default and aws_ebs_default_kms_key resources:

resource "aws_ebs_encryption_by_default" "enabled" {
  enabled = true
}

resource "aws_kms_key" "ebs_default" {
  description             = "Customer managed default KMS key for EBS"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

resource "aws_ebs_default_kms_key" "custom_default" {
  key_arn = aws_kms_key.ebs_default.arn
}

Preventing Users from Disabling Default Encryption

Enabling the EC2 regional setting ensures new volumes are encrypted, but IAM principals with sufficient EC2 permissions could still run DisableEbsEncryptionByDefault or ResetEbsDefaultKmsKeyId. In a multi-account AWS Organizations environment, you should apply a Service Control Policy (SCP) to prevent anyone from turning off default encryption:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventDisablingDefaultEBSEncryption",
      "Effect": "Deny",
      "Action": [
        "ec2:DisableEbsEncryptionByDefault",
        "ec2:ResetEbsDefaultKmsKeyId"
      ],
      "Resource": "*"
    }
  ]
}

Additionally, you can deploy the AWS Config managed rule ec2-ebs-encryption-by-default across all regions and accounts to continuously audit compliance and trigger automated remediation if a new region or account does not yet have the setting enabled.

Important Considerations for KMS Key Policies

If you configure a customer managed KMS key as the default EBS encryption key and your account uses Amazon EC2 Auto Scaling groups or AWS Spot Fleet, you must ensure the KMS key policy grants access to the AWS Service-Linked Role used by Auto Scaling (AWSServiceRoleForAutoScaling). Without permission to kms:CreateGrant and cryptographic actions (kms:Encrypt, kms:Decrypt, kms:ReEncrypt*, kms:GenerateDataKey*, kms:DescribeKey), Auto Scaling instances will fail to launch when attempting to attach encrypted root or data volumes.