Severity Framework
Snyk CCSS
Rule category
Data / Access
Is your enviroment affected by this misconfiguration?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsFrameworks
CIS-AWS
CIS-Controls
CSA-CCM
GDPR
HIPAA
ISO-27001
NIST-800-53
SOC-2
- Snyk ID SNYK-CC-00342
- credit Snyk Research Team
Description
If someone gains unauthorized access to the root block device's data, they would be able to read its contents.
How to fix?
Set the root_block_device.encrypted
attribute to true
.
Example Configuration
# aws_instance example
resource "aws_instance" "encrypted" {
ami = "id-abcd1234"
instance_type = "t3.micro"
root_block_device {
encrypted = true
}
tags = {
Name = "HelloWorld"
}
}
# aws_launch_configuration example
resource "aws_launch_configuration" "encrypted" {
name = "web_config"
image_id = "id-1234abcd"
instance_type = "t2.micro"
root_block_device {
encrypted = true
}
}
# aws_spot_fleet_request example
resource "aws_spot_fleet_request" "encrypted" {
iam_fleet_role = "arn:aws:iam::123456789012:role/spot-fleet"
spot_price = "0.03"
allocation_strategy = "diversified"
target_capacity = 6
valid_until = "2019-11-04T20:44:20Z"
launch_specification {
instance_type = "m4.10xlarge"
ami = "ami-1234abcd"
spot_price = "2.793"
placement_tenancy = "dedicated"
iam_instance_profile_arn = "arn:aws:iam::123456789012:role/spot-fleet"
root_block_device {
encrypted = true
}
}
}
# aws_spot_instance_request example
resource "aws_spot_instance_request" "encrypted" {
ami = "ami-1234abcd"
spot_price = "0.03"
instance_type = "c4.xlarge"
root_block_device {
encrypted = true
}
tags = {
Name = "HelloWorld"
}
}