6WAF

EBS encryption by default is off in a Region

MEDIUM

What's the problem

New volumes and snapshot copies in the Region are not encrypted unless each launch asks for it. Turning the default on does not touch running volumes; a 1-click fix is available

How 6WAF detects it

  • Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS, Secrets Manager, ACM, detection services) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
  • Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
  • Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.

Pillar: Security — Fast Scan

Group: Data protection (S3, EBS, KMS, ACM, snapshots, AMIs)

Reference standard: AWS Security Hub EC2.7

Get the 39-point AWS waste checklist by email (free, self-serve)

Unticked: we only send the checklist and delete the email after 90 days. Privacy policy

Scan this check (and the other 132) automatically in ~10 minutes

Start free

Related checks

S3 bucket Public Access Block missing or incompleteS3 account-level Public Access Block not fully enabledS3 bucket uses SSE-S3 (informational)S3 bucket uses SSE-KMS without Bucket Key