Description

This detector identifies AWS WorkSpaces that have unencrypted volumes, which could expose sensitive data. It checks both root volumes and user volumes for each WorkSpace instance to ensure proper encryption is enabled, as unencrypted WorkSpace volumes pose a security risk for data at rest.

Detection Strategy

• Reports a vulnerability when a WorkSpace has root volume encryption disabled (RootVolumeEncryptionEnabled = false)

• Reports a vulnerability when a WorkSpace has user volume encryption disabled (UserVolumeEncryptionEnabled = false)

• Checks all WorkSpaces in the specified AWS region and reports each instance that has either or both volume types unencrypted