How to Enforce Default EBS Encryption and Block Unencrypted Volumes?

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

A Configure the EC2 account attribute to always encrypt new EBS volumes so encryption by default is enforced and unencrypted volumes cannot be created.

Question

A company plans to rehost an application to Amazon EC2 instances that use Amazon Elastic Block Store (Amazon EBS) as the attached storage. A solutions architect must design a solution to ensure that all newly created Amazon EBS volumes are encrypted by default. The solution must also prevent the creation of unencrypted EBS volumes. Which solution will meet these requirements?
  1. Configure the EC2 account attributes to always encrypt new EBS volumes. Correct Answer
  2. Use AWS Config. Configure the encrypted-volumes identifier. Apply the default AWS Key Management Service (AWS KMS) key.
  3. Configure AWS Systems Manager to create encrypted copies of the EBS volumes. Reconfigure the EC2 instances to use the encrypted volumes.
  4. Create a customer managed key in AWS Key Management Service (AWS KMS). Configure AWS Migration Hub to use the key when the company migrates workloads.

Key Takeaways

This question tests the difference between preventive account-level EBS encryption-by-default settings and detective AWS Config remediation; the trap is assuming AWS Config can block unencrypted volume creation.

Amazon EBS encryption by default is a Region-level EC2 account attribute that automatically encrypts all new EBS volumes and prevents unencrypted volume creation. For a rehosted EC2 application, configuring that attribute (option A) is the direct control that satisfies both requirements.

Common mistake: Learners often choose AWS Config (B) because a Config rule can detect unencrypted volumes and trigger remediation, but detection and post-creation remediation do not prevent an unencrypted EBS volume from being created in the first place.

Expert Analysis

Why the Answer Is Correct

Option A configures the EC2 account attribute in the Region so that every newly created EBS volume and snapshot copy is encrypted using the default AWS KMS key. AWS documents encryption by default as an enforcement setting: once enabled, new EBS volumes cannot be created unencrypted. For the rehosted application, this covers volumes created during EC2 launch and any extra volumes added later, so it meets both the default-encryption and prevention requirements without manual intervention. The account-level setting is preventive and applies at volume creation time, which is exactly what the question asks.

Why the Other Options Are Wrong

Option B uses AWS Config with the encrypted-volumes rule, which is a detective compliance check; it can flag noncompliant volumes and invoke remediation, but the volume still gets created unencrypted before any corrective action. Option C creates encrypted copies after the fact and reconfigures instances, so it does not prevent unencrypted volume creation and adds operational risk. Option D introduces a customer managed KMS key but attaches it to AWS Migration Hub, which tracks migrations and does not enforce EBS encryption defaults.

Community Comment Notes

Scheldon cites the EBS encryption-by-default documentation and says the task is to "force automatic encryption for every new EBS volume" and block unencrypted volumes. EdricHoang and lsomas lean toward B, with lsomas stating "As it needs to prevent creation of Unencrypted EBS volume", but AWS Config is not a preventive block on the CreateVolume API. LeonSauveterre argues that A "automatically encrypts all newly created volumes" while claiming it cannot prevent unencrypted volumes; the official docs disprove that claim because encryption by default removes the unencrypted-volume creation path. Several learners link the AWS encryption-by-default page as the decisive reference.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question uses words like “prevent” or “ensure by default,” prefer native preventive controls such as EBS encryption by default over detective services like AWS Config. Confirm whether the service acts at resource-creation time or only evaluates and remediates after the resource exists.

Frequently Asked Questions

Why is an AWS Config encrypted-volumes rule not sufficient to prevent unencrypted EBS volumes?

AWS Config is detective: it evaluates existing volumes and can trigger remediation, but it does not block the CreateVolume action, so an unencrypted volume can still be created before the rule reacts.

Does EBS encryption by default encrypt existing volumes or only new ones?

Encryption by default applies to newly created EBS volumes and snapshot copies in the Region; it does not retroactively encrypt existing unencrypted volumes or snapshots.

More SAA-C03 FAQ →

Community Votes

A
61%
B
39%

61% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Scheldon 👍 9 Answered A
    AnswerA The task is to force automatic encryption for every new EBS volume and prevent possibility of creation any unencrypted volume hence: https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#ebs-encryption_key_mgmt To enable encryption by default for a Region Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/. From the navigation bar, select the Region. From the navigation pane, select EC2 Dashboard. In the upper-right corner of the page, choose Account Attributes, Data protection and security. Choose Manage. Select Enable. You keep the AWS managed key with the alias alias/aws/ebs created on your behalf as the default encryption key, or choose a symmetric customer managed encryption key. Choose Update EBS encryption.
  2. EdricHoang 👍 3 Answered B
    "The solution must also prevent the creation of unencrypted EBS volumes." For prevention future actions, I go for AWS config. You can setup Encryption in EC2, but Its manual process, what happen if you add one or more EC2?
  3. viejito 👍 3
    B es correcto , AWS Config para identificar automáticamente los volúmenes de EBS no cifrados y aplicar una acción correctiva.A,C,D : incorrectas , no cumplen con el cifrado automático
  4. lsomas 👍 3 Answered B
    As it needs to prevent creation of Unencrypted EBS volume
  5. 0bdf3af 👍 2
    A. https://repost.aws/knowledge-center/ebs-automatic-encryption
Show 4 more comments
  1. FlyingHawk 👍 1 Answered A
    https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot. For examples of transitioning from unencrypted to encrypted EBS resources, see https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption.html#encrypt-unencrypted: To enable encryption by default for a Region %aws ec2 enable-ebs-encryption-by-default --region region In the upper-right corner of the page, choose Account Attributes, Data protection and security.
  2. Scheldon 👍 1
    AnswerA https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#ebs-encryption_key_mgmt To enable encryption by default for a Region Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/. From the navigation bar, select the Region. From the navigation pane, select EC2 Dashboard. In the upper-right corner of the page, choose Account Attributes, Data protection and security. Choose Manage. Select Enable. You keep the AWS managed key with the alias alias/aws/ebs created on your behalf as the default encryption key, or choose a symmetric customer managed encryption key. Choose Update EBS encryption.
  3. LeonSauveterre 👍 1 Answered B
    A - This automatically encrypts all newly created volumes, but can't prevent unencrypted volumes. B - AWS Config can enforce and automate compliance by using a rule to check whether all EBS volumes are encrypted. C - Creating encrypted copies of volumes after they are created? Why bother to do this D - What does Migration Hub have to do with this... I don't understand.
  4. Xandero 👍 1 Answered A
    https://docs.aws.amazon.com/ebs/latest/userguide/encryption-by-default.html

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide