Homepage
About Snyk

Root block device is not encrypted Affecting EC2 service in AWS

0.0
medium
0
10
    Severity Framework Snyk CCSS
    Rule category Data / Access

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-AWS CIS-Controls CSA-CCM GDPR HIPAA ISO-27001 NIST-800-53 SOC-2
  • Snyk ID SNYK-CC-00342
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

If someone gains unauthorized access to the root block device's data, they would be able to read its contents.

How to fix?

Set the root_block_device.encrypted attribute to true.

Example Configuration

# aws_instance example
resource "aws_instance" "encrypted" {
  ami           = "id-abcd1234"
  instance_type = "t3.micro"

  root_block_device {
    encrypted = true
  }

  tags = {
    Name = "HelloWorld"
  }
}

# aws_launch_configuration example
resource "aws_launch_configuration" "encrypted" {
  name          = "web_config"
  image_id      = "id-1234abcd"
  instance_type = "t2.micro"

  root_block_device {
    encrypted = true
  }
}

# aws_spot_fleet_request example
resource "aws_spot_fleet_request" "encrypted" {

  iam_fleet_role      = "arn:aws:iam::123456789012:role/spot-fleet"
  spot_price          = "0.03"
  allocation_strategy = "diversified"
  target_capacity     = 6
  valid_until         = "2019-11-04T20:44:20Z"

  launch_specification {
    instance_type            = "m4.10xlarge"
    ami                      = "ami-1234abcd"
    spot_price               = "2.793"
    placement_tenancy        = "dedicated"
    iam_instance_profile_arn = "arn:aws:iam::123456789012:role/spot-fleet"
    root_block_device {
      encrypted = true
    }
  }
}

# aws_spot_instance_request example
resource "aws_spot_instance_request" "encrypted" {
  ami           = "ami-1234abcd"
  spot_price    = "0.03"
  instance_type = "c4.xlarge"

  root_block_device {
    encrypted = true
  }

  tags = {
    Name = "HelloWorld"
  }
}