---
title: EBS volume snapshot not encrypted
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Infrastructure as Code (IaC)
  Security > IaC Security Rules > EBS volume snapshot not encrypted
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EBS volume snapshot not encrypted

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

## Metadata{% #metadata %}

**Id:** `terraform-aws-ebs-volume-snapshot-not-encrypted` 

**Provider:** AWS

**Platform:** Terraform

**Severity:** High

**Category:** Encryption

#### Learn More{% #learn-more %}

- [Provider Reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ebs_volume#encrypted)

### Description{% #description %}

EBS volume snapshots should be encrypted to protect sensitive data at rest from unauthorized access. A snapshot inherits its encryption status from the source EBS volume, so when the source volume is unencrypted, sensitive information is potentially exposed if the snapshot is accessed by malicious actors. The security impact includes potential data breaches, compliance violations, and unauthorized data access even if the original volume is no longer in use.

To ensure proper encryption, create the source EBS volume with encryption enabled. For example:

```
resource "aws_ebs_volume" "secure_example" {
  availability_zone = "us-west-2a"
  size              = 40
  encrypted         = true
}

resource "aws_ebs_snapshot" "negative1" {
  volume_id = aws_ebs_volume.secure_example.id
}
```

## Compliant Code Examples{% #compliant-code-examples %}

```terraform
resource "aws_ebs_volume" "negative1" {
  availability_zone = "us-west-2a"
  size              = 40

  tags = {
    Name = "HelloWorld"
  }
}

resource "aws_ebs_snapshot" "negative1" {
  volume_id = aws_ebs_volume.negative1.id
  encrypted = true
}
```

```terraform
# Companion of negative.tf, but the snapshot never sets encrypted at all
# (unlike negative1's literal encrypted = true) - it inherits encryption
# from its source volume, which is itself encrypted. See test/negative2.json
# and linked_volume_encrypted() in query.rego.
resource "aws_ebs_volume" "negative2" {
  availability_zone = "us-west-2a"
  size              = 40
  encrypted         = true

  tags = {
    Name = "HelloWorld"
  }
}

resource "aws_ebs_snapshot" "negative2" {
  volume_id = aws_ebs_volume.negative2.id
}
```

## Non-Compliant Code Examples{% #non-compliant-code-examples %}

```terraform
resource "aws_ebs_volume" "positive1" {
  availability_zone = "us-west-2a"
  size              = 40
  encrypted = false
  tags = {
    Name = "HelloWorld"
  }
}

resource "aws_ebs_snapshot" "positive1" {
  volume_id = aws_ebs_volume.positive1.id
  encrypted         = false
}
```

```terraform
resource "aws_ebs_volume" "positive2" {
  availability_zone = "us-west-2a"
  size              = 40

  tags = {
    Name = "HelloWorld"
  }
}

resource "aws_ebs_snapshot" "positive2" {
  volume_id = aws_ebs_volume.positive2.id
  tags {
    Name = "Production"
  }
}
```