EBS encryption by default is an account setting, per AWS Region, that makes every new volume and snapshot copy encrypted. It does not change volumes or snapshots that already exist, and once enabled in a Region you cannot opt individual volumes out. Turn it on in every Region, then plan a migration for unencrypted volumes.
What the setting does
AWS says you can configure your account to enforce encryption of new EBS volumes and of snapshot copies you create. That includes volumes created when you launch an instance and snapshots copied from an unencrypted snapshot.
Three points from the documentation shape how you roll it out:
- It is Region specific. Enable it in each Region you use, including ones you think you do not use.
- No per-volume opt out. Once on for a Region, you cannot disable it for individual volumes or snapshots there.
- No effect on existing resources. Existing volumes and snapshots stay as they are.
It works on current and previous generation instance types.
Choosing the key
By default, EBS uses an AWS managed key with the alias aws/ebs, created for you in each Region. You can change the default to a symmetric customer managed key.
A customer managed key gives you control over the key policy, rotation and who can use the key, and it shows key use in your audit logs. The tradeoff is operational. If someone deletes or disables the key, the volumes encrypted with it become unusable, so protect the key itself.
AWS also says you cannot change the key on an existing snapshot or encrypted volume. You can pick a different key when you copy a snapshot. Note that copying and encrypting with a new key creates a complete, non-incremental copy, which adds storage cost.
Enabling it
In the console: open the EC2 console, choose the Region, go to Settings, then the Data protection and security tab, find EBS encryption, choose Manage and select Enable.
From the CLI, the command is enable-ebs-encryption-by-default with a Region. AWS documents a loop over all Regions in your account, and a matching get command to verify.
aws ec2 get-ebs-encryption-by-default --region us-east-1
aws ec2 enable-ebs-encryption-by-default --region us-east-1
For many accounts, set it from your provisioning code or account baseline, so new accounts start encrypted.
Dealing with existing volumes
Because the setting is not retroactive, you need an inventory.
- List volumes where encrypted is false, across Regions and accounts.
- For each, snapshot it, copy the snapshot with encryption on, create a new volume from the encrypted copy, and swap it onto the instance during a maintenance window. AWS has a section on transitioning from unencrypted to encrypted resources.
- Delete the old unencrypted volume and snapshots once you have verified the swap.
- Check launch templates and AMIs. An AMI built from unencrypted snapshots will still launch, but its volumes will now be encrypted by the default setting.
What it does not do
Encryption at rest protects against lost or improperly retired storage media and against someone reading a snapshot outside your account without access to the key. It does not protect data from a process or person that can legitimately use the instance, or from an attacker holding the instance role. Treat it as one layer.
Quick check
Will turning it on break running instances?
No. Existing volumes are not changed. Only newly created volumes and snapshot copies are affected.
Does it cost extra?
Encryption by default itself is a setting. Copying a snapshot to a new key creates a full copy, which AWS notes adds storage cost. Check current pricing for KMS key use.
Sources
Last reviewed: 19 October 2026.
