Encrypt Launch Configuration EBS Data

Violation ID: BC_AWS_GENERAL_13

Ensure all Data Stored in the Launch Configuration EBS is Securely Encrypted


Amazon Elastic Block Store (EBS) volumes allow you to create encrypted launch configurations when creating EC2 instances and auto scaling.


When the entire EBS volume is encrypted, data stored at rest on the volume, disk I/O, snapshots created from the volume, and data in-transit between EBS and EC2 are all encrypted.

Automated Remediation

Runtime Resource


Buildtime Resource


Resource: aws_launch_configuration
Argument: encrypted - (Optional) Whether the volume should be encrypted or not. Do not use this option if you are using snapshot_id as the encrypted flag will be determined by the snapshot. (Default: false).

resource "aws_launch_configuration" "as_conf" {
  name_prefix   = "terraform-lc-example-"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = "t2.micro"

  +root_block_device {
  +  encrypted             = true

Manual Remediation

Runtime Resource


To change the policy using the AWS Console, follow these steps:

  1. Login to the AWS Management Console at https://console.aws.amazon.com/.
  2. Open the EC2 console.
  3. Navigate to the Auto Scaling section.
  4. Create a new launch configuration.
  5. Add an encrypted EBS volume (Add Storage).

CLI Command

aws autoscaling create-launch-configuration --launch-configuration-name my-launch-config --image-id ami-c6169af6 --instance-type m1.medium --encrypted true

Updated about a month ago

Encrypt Launch Configuration EBS Data

Violation ID: BC_AWS_GENERAL_13

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.