Config rule for encrypted volumes disabled

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: ansible-aws-config-rule-for-encrypted-volumes-is-disabled

Provider: AWS

Platform: Ansible

Severity: High

Category: Encryption

Learn More

Description

Missing an AWS Config rule for encrypted volumes prevents automated detection of unencrypted block storage and snapshots, leaving data at rest vulnerable to exposure if storage is compromised.

For Ansible-managed resources, define an aws_config_rule (module community.aws.config_rule or aws_config_rule) with source.identifier set to ENCRYPTED_VOLUMES. The check is case-insensitive. Tasks that omit this aws_config_rule or set source.identifier to a different value are flagged.

Secure Ansible example:

- name: Ensure AWS Config rule for encrypted volumes exists
  community.aws.config_rule:
    name: encrypted-volumes-rule
    source:
      owner: AWS
      identifier: ENCRYPTED_VOLUMES

Compliant Code Examples

- name: foo
  community.aws.config_rule:
    name: test_config_rule
    state: present
    description: This AWS Config rule checks for public write access on S3 buckets
    scope:
      compliance_types:
      - AWS::S3::Bucket
    source:
      owner: AWS
      identifier: ENCRYPTED_VOLUMES

Non-Compliant Code Examples

---
- name: foo
  community.aws.config_rule:
    name: test_config_rule
    state: present
    description: 'This AWS Config rule checks for public write access on S3 buckets'
    scope:
      compliance_types:
        - 'AWS::S3::Bucket'
    source:
      owner: AWS
      identifier: 'S3_BUCKET_PUBLIC_WRITE_PROHIBITED'