I hate blind system scans…
Customer #Security Team: "It looks like a bunch of #EC2s' disks aren't encrypted."
Me: "I'm almost certain that the security controls on those accounts force EC2s' attached #EBS volumes to be encrypted at the virtual-hardware level."
CST: "We're going to need proof of that"
Me: "Ok. Well, if you do…
$ aws ec2 describe-volumes --volume-ids $( aws ec2 describe-instances --instance-ids $(
for AMI in $(
aws ec2 describe-images \
--filters "Name=name,Values=spel-minimal-*-9*" \
--query 'sort_by(Images, &CreationDate)[? CreationDate >= `2025-11-01` ].{ImageId:ImageId}' \
--output text
)
do
aws ec2 run-instances \
--image-id "${AMI}" \
--instance-type t3.medium \
--key-name 'thjones2-rsav2-sha2-512' \
--security-group-id sg-5cd0cb66dadf8434f \
--subnet-id subnet-c0da6d2348d529672 \
--iam-instance-profile 'Name=INSTANCE_SSM' \
--query 'Instances[].InstanceId' \
--count 1 \
--output text
done
) --query 'Reservations[].Instances[].BlockDeviceMappings[].Ebs.VolumeId' \
--output text
) --query 'Volumes[].{VolumeId:VolumeId,Encrypted:Encrypted}'It will show something like:[
{
"VolumeId": "vol-0d10e56ba93e5d7e0",
"Encrypted": true
},
{
"VolumeId": "vol-01796d906e9822652",
"Encrypted": true
},
{
"VolumeId": "vol-065751096e45c94fb",
"Encrypted": true
},
{
"VolumeId": "vol-0834a7e5d4a2ff6f0",
"Encrypted": true
},
{
"VolumeId": "vol-0793f989945229fb8",
"Encrypted": true
}
]
Note: #AWS object-IDs have been changed (openssl rand -hex 20 | cut -c 1-17 is dast-handy) to protect the guilty.
Omroep West
DevTo VN Bot
Blake Patterson
ferricoxide
Nobody
maniabel