Find Unencrypted EBS Volumes and Turn On Default Encryption

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadEbsEncryptionState",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "ec2:DescribeVolumes",
        "ec2:GetEbsEncryptionByDefault",
        "ec2:GetEbsDefaultKmsKeyId"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OptionalEnableDefaultEncryption",
      "Effect": "Allow",
      "Action": "ec2:EnableEbsEncryptionByDefault",
      "Resource": "*"
    }
  ]
}

// find-unencrypted-ebs-volumes.ts
// Lists unencrypted EBS volumes in every enabled Region and shows whether
// EBS encryption by default is on. Read-only by default.
// With --enable-default it shows the Regions where it would turn on encryption
// by default (dry run); add --apply to make the change. Existing volumes are never modified.
// Usage: npx tsx find-unencrypted-ebs-volumes.ts [--regions us-east-1,eu-west-1] [--enable-default [--apply]]
import {
  EC2Client,
  DescribeRegionsCommand,
  GetEbsEncryptionByDefaultCommand,
  GetEbsDefaultKmsKeyIdCommand,
  EnableEbsEncryptionByDefaultCommand,
  paginateDescribeVolumes,
} from "@aws-sdk/client-ec2";

const enableDefault = process.argv.includes("--enable-default");
const apply = process.argv.includes("--apply");

function regionsArg(): string[] | undefined {
  const i = process.argv.indexOf("--regions");
  if (i === -1) return undefined;
  const list = (process.argv[i + 1] ?? "").split(",").map((r) => r.trim()).filter(Boolean);
  if (list.length === 0) throw new Error("--regions needs a comma-separated list");
  return list;
}

type VolumeRow = {
  region: string;
  volumeId: string;
  sizeGiB: number;
  type: string;
  state: string;
  instance: string;
  name: string;
};

type RegionRow = {
  region: string;
  defaultEncryption: string;
  defaultKey: string;
  unencrypted: number;
};

async function listRegions(): Promise<string[]> {
  const explicit = regionsArg();
  if (explicit) return explicit;
  const ec2 = new EC2Client({ region: process.env.AWS_REGION ?? "us-east-1" });
  // Without AllRegions, DescribeRegions returns only the Regions enabled for the account.
  const { Regions } = await ec2.send(new DescribeRegionsCommand({}));
  return (Regions ?? []).map((r) => r.RegionName).filter((r): r is string => Boolean(r)).sort();
}

async function main(): Promise<void> {
  const volumes: VolumeRow[] = [];
  const regions: RegionRow[] = [];

  for (const region of await listRegions()) {
    const ec2 = new EC2Client({ region, maxAttempts: 5 });
    const { EbsEncryptionByDefault } = await ec2.send(new GetEbsEncryptionByDefaultCommand({}));
    const { KmsKeyId } = await ec2.send(new GetEbsDefaultKmsKeyIdCommand({}));

    let count = 0;
    const pages = paginateDescribeVolumes(
      { client: ec2 },
      { Filters: [{ Name: "encrypted", Values: ["false"] }] },
    );
    for await (const page of pages) {
      for (const v of page.Volumes ?? []) {
        count++;
        volumes.push({
          region,
          volumeId: v.VolumeId ?? "?",
          sizeGiB: v.Size ?? 0,
          type: v.VolumeType ?? "?",
          state: v.State ?? "?",
          instance: v.Attachments?.[0]?.InstanceId ?? "-",
          name: v.Tags?.find((t) => t.Key === "Name")?.Value ?? "",
        });
      }
    }
    regions.push({
      region,
      defaultEncryption: EbsEncryptionByDefault ? "on" : "OFF",
      defaultKey: KmsKeyId ?? "-",
      unencrypted: count,
    });
  }

  console.table(regions);
  console.table(volumes);
  const totalGiB = volumes.reduce((sum, v) => sum + v.sizeGiB, 0);
  console.log(`${volumes.length} unencrypted volumes (${totalGiB} GiB) in ${regions.length} Regions.`);
  if (!enableDefault) return;

  const targets = regions.filter((r) => r.defaultEncryption === "OFF");
  console.log(`\n${apply ? "Enabling" : "Dry run: would enable"} encryption by default in ${targets.length} Regions:`);
  for (const r of targets) {
    console.log(`  ${r.region}`);
    if (!apply) continue;
    const ec2 = new EC2Client({ region: r.region });
    const out = await ec2.send(new EnableEbsEncryptionByDefaultCommand({}));
    console.log(`    EbsEncryptionByDefault=${String(out.EbsEncryptionByDefault)}`);
  }
  if (!apply && targets.length > 0) console.log("Re-run with --enable-default --apply to make the change.");
}

main().catch((err: unknown) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report: every enabled Region
AWS_PROFILE=security-audit npx tsx find-unencrypted-ebs-volumes.ts

# Only the Regions you use
AWS_PROFILE=security-audit npx tsx find-unencrypted-ebs-volumes.ts --regions us-east-1,eu-west-1

# Dry run: which Regions would get encryption by default
AWS_PROFILE=ops-admin npx tsx find-unencrypted-ebs-volumes.ts --enable-default

# Make the change
AWS_PROFILE=ops-admin npx tsx find-unencrypted-ebs-volumes.ts --enable-default --apply

┌─────────┬─────────────┬───────────────────┬─────────────────┬─────────────┐
│ (index) │ region      │ defaultEncryption │ defaultKey      │ unencrypted │
├─────────┼─────────────┼───────────────────┼─────────────────┼─────────────┤
│ 0       │ 'eu-west-1' │ 'OFF'             │ 'alias/aws/ebs' │ 1           │
│ 1       │ 'us-east-1' │ 'OFF'             │ 'alias/aws/ebs' │ 2           │
│ 2       │ 'us-west-2' │ 'on'              │ 'alias/aws/ebs' │ 0           │
└─────────┴─────────────┴───────────────────┴─────────────────┴─────────────┘
┌─────────┬─────────────┬─────────────────────────┬─────────┬───────┬─────────────┬───────────────────────┬──────────────┐
│ (index) │ region      │ volumeId                │ sizeGiB │ type  │ state       │ instance              │ name         │
├─────────┼─────────────┼─────────────────────────┼─────────┼───────┼─────────────┼───────────────────────┼──────────────┤
│ 0       │ 'eu-west-1' │ 'vol-0a1b2c3d4e5f60718' │ 100     │ 'gp2' │ 'available' │ '-'                   │ 'old-export' │
│ 1       │ 'us-east-1' │ 'vol-049df61146c4d7901' │ 30      │ 'gp3' │ 'in-use'    │ 'i-0123456789abcdef0' │ 'web-1-root' │
│ 2       │ 'us-east-1' │ 'vol-0f9e8d7c6b5a43210' │ 500     │ 'gp3' │ 'in-use'    │ 'i-0123456789abcdef0' │ 'web-1-data' │
└─────────┴─────────────┴─────────────────────────┴─────────┴───────┴─────────────┴───────────────────────┴──────────────┘
3 unencrypted volumes (630 GiB) in 3 Regions.