CBL-IPF_EBS_Encryption_(2023-08).docx
DOCX document 63 KB Posted
- Attached to
- FS3i-RFI
- Solicitation number
- FS3i-TBD
About this file
This document is an IPF Policy on EBS Volume Encryption. The goal of this policy is to ensure all new and existing Elastic Block Store (EBS) volumes in the cloud environments on all domains are properly encrypted to improve the security posture of the IPF program. The key points are:
- All new EC2 instances must have encrypted storage configured.
- All new EBS volumes created must be encrypted using either a default AWS KMS key or a customer-managed KMS key.
- All existing unencrypted EBS volumes attached to running instances must be encrypted by creating an encrypted snapshot, copying it, and attaching the new encrypted volume.
This policy aims to address the issue of unencrypted EBS volumes being used, which goes against agency best practices for securing data.
View the file
Other files
Show all 25
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
UNCLASSIFIED
IPF Policy EBS Volume Encryption 2023-07-27 Purpose Historically within IPF, monthly data has shown there are a number of unencrypted EBS volumes being used in the cloud environments on all domains. This goes against agency best practices for securing data. The goal of this policy is to ensure all new, and existing EBS volumes will be properly encrypted to better improve the security posture of the IPF program going forward.
Policy for EBS Encryption
1. All new EC2 instances that are spun up, need to have storage configured to use encryption. This can be configured in the ‘Advanced’ options of the storage settings when launching an EC2.
2. All new EBS volumes that are created from the EBS console need to be encrypted.
3. A default AWS KMS key, or an existing customer managed KMS key can be used for the encryption.
a. Customer managed keys are preferred due to more flexibility, including the ability to create, rotate, and disable KMS keys.
4. All existing unencrypted EBS volumes attached to running instance need to be encrypted. This cannot be done directly.
a. Stop your EC2 instance.
b. Create an EBS snapshot of the volume you want to encrypt.
c. Copy the EBS snapshot, encrypting the copy in the process.
d. Create a new EBS volume from your new encrypted EBS snapshot. The new EBS volume will be encrypted.
e. Detach the original EBS volume and attach your new encrypted EBS volume, making sure to match the device name (/dev/xvda1, etc.)
f. Start the EC2 instance.
Supporting documentation can be found here: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html image1.png
File details come from the government source that posted it. Updated .