Sigma medium stable sigma

AWS EC2 Disable EBS Encryption

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

View Source

Detection Logic

{
  "selection": {
    "eventSource": "ec2.amazonaws.com",
    "eventName": "DisableEbsEncryptionByDefault"
  },
  "condition": "selection"
}

False Positives

⚠ System Administrator Activities
⚠ DEV, UAT, SAT environment. You should apply this rule with PROD account only.

Field Validations

Loading…

Comments (0)

Loading comments...