c2.17 Encrypt data at rest
AWS storage services offer server-side encryption with minimal effort, so encrypt everything. For sensitive data, use your own AWS KMS keys so you control the key, can share it across accounts, and can set rotation to your compliance needs.
Implementation guidance
Encrypt everything, own the sensitive keys
Most AWS storage services support server-side encryption you can enable with almost no effort — turn it on broadly. For sensitive data, use a customer managed key in AWS KMS rather than an AWS-owned key, because it lets you:
- disable the key to cut access,
- share it across accounts (useful for handing snapshots to an incident-response team),
- and set a rotation interval that matches your compliance requirements.
Verify encryption at scale
Use AWS Security Hub CSPM controls to find unencrypted resources across the organization — for example EBS volumes and RDS instances that lack encryption at rest — plus controls covering DynamoDB, OpenSearch, EKS secrets, and more.
KMS vs. CloudHSM
Prefer KMS: it is more cost-effective, highly available across AZs, and backed by tamper-resistant HSMs. Choose AWS CloudHSM only when you specifically need a single-tenant, dedicated HSM — and if you do, run a cluster across multiple Availability Zones for high availability.
Key material
Unless you have a strong reason, avoid importing external key material or using an external key store — both carry security and durability trade-offs compared with KMS-generated keys.
Turn on EBS encryption by default
Enable account-level default encryption for new EBS volumes (per Region). Confirm it is on:
aws ec2 enable-ebs-encryption-by-default
aws ec2 get-ebs-encryption-by-defaultHow to validate
- Is all critical and sensitive data encrypted at rest?
- Are you using customer managed KMS keys for sensitive data, with rotation set to your needs?
- Do you use Security Hub CSPM controls to detect unencrypted resources across the organization?
Threats addressed
- Unencrypted data at rest is readable by anyone who obtains the underlying storage (a shared snapshot, a stolen volume, a misconfigured bucket), turning a storage exposure into a data breach.
AWS services
AWS KMS 
Amazon EBS 
AWS Security Hub Pricing
The AWS Free Tier includes 20,000 free AWS KMS requests per month; beyond that you pay per key and per request. See AWS KMS pricing.