Description

Detects unencrypted EBS (Elastic Block Store) volumes attached to EC2 instances in CloudFormation templates. Unencrypted EBS volumes pose a security risk since the data stored on them is not protected at rest, potentially exposing sensitive information if the physical storage is compromised.

Detection Strategy

• Reviews CloudFormation templates looking for AWS::EC2::Instance resource types

• Examines the BlockDeviceMappings property of EC2 instances

• Reports a vulnerability when an EBS volume is defined without setting the 'Encrypted' property to true

• Checks both root volumes and additional EBS volumes attached to the instance

Vulnerable code example

{
  "Resources": {
    "VulnerableEC2Instance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": "ami-12345678",
        "BlockDeviceMappings": [
          {...

✅ Secure code example

{
  "Resources": {
    "VulnerableEC2Instance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": "ami-12345678",
        "BlockDeviceMappings": [
          {...