---
title: EBS default encryption should be enabled
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > EBS default encryption should be
  enabled
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# EBS default encryption should be enabled
 
## Description{% #description %}

Amazon EBS default encryption should be enabled in every region in use so that all new EBS volumes and snapshots are encrypted automatically. EBS encryption by default is configured per region, and this rule checks that `EbsEncryptionByDefault` is `true` for each region. If you lose access to or delete the KMS key used by encrypted volumes, you can't access those volumes.

## Remediation{% #remediation %}

1. In the [Amazon EC2 console](https://console.aws.amazon.com/ec2/), under **Account attributes**, select **Data protection and security**, then under **EBS encryption** click **Manage**, check **Enable**, and click **Update EBS encryption**. Repeat for each region where encryption by default is not enabled.
1. Alternatively, run `aws --region <region> ec2 enable-ebs-encryption-by-default` for each affected region using the [enable-ebs-encryption-by-default](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ebs-encryption-by-default.html) command, and confirm with [get-ebs-encryption-by-default](https://docs.aws.amazon.com/cli/latest/reference/ec2/get-ebs-encryption-by-default.html) that `"EbsEncryptionByDefault": true` is returned.

## References{% #references %}

- [Amazon EBS encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html)
- [AWS CLI: enable-ebs-encryption-by-default](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ebs-encryption-by-default.html)
- [AWS CLI: get-ebs-encryption-by-default](https://docs.aws.amazon.com/cli/latest/reference/ec2/get-ebs-encryption-by-default.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)