Documentation
README
Ensure Amazon Machine Images (AMIs) are encrypted
Description
Amazon Machine Images should utilize EBS Encrypted snapshots.
Rationale
AMIs backed by EBS snapshots should use EBS encryption. Snapshot volumes can be encrypted and attached to an AMI.
Impact
Encrypting AMIs may add slight overhead to instance launch times and requires KMS key management. Existing unencrypted AMIs must be copied with encryption enabled and old ones deregistered.
Audit Procedure
Using AWS CLI
- Run the aws ec2 describe-images command to find unencrypted AMIs:
aws ec2 describe-images --region us-east-1 --owner self --filter "Name=block-device-mapping.encrypted,Values=false" --query "Images[*].[ImageId]"
This is the opening of the README. Read the full README on GitHub.