<p>Here is what I ended up using. Enjoy. </p>

<pre><code>for instance in $instances;
do
  count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r '. | length';`
  name=`aws ec2 describe-tags --filters Name=resource-id,Values=$instance Name=key,Values=Name --query Tags[].Value | jq -r '.[0]'`
  if [ $count -gt 0 ]; then
    START=0
    END=$count
    for ((i=START; i&lt;END; i++))
    do
       #echo "i: $i"
       encrypted=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r ".[$i].Encrypted";`
       volumeid=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r ".[$i].VolumeId";`
       echo "$instance $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted "
    done
  fi
done
</code></pre>

CC BY-SA 3.0
2017-05-22T11:47:20.967Z
2017-05-22T11:47:20.967Z
hawkeye
<p>I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output:</p>

<pre><code>instances=`aws ec2 describe-instances --region us-east-1 --filters Name=instance-state-name,Values=running --query "Reservations[*].Instances[0].InstanceId" --output text`

for instance in $instances; 
do  
   aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=true Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"; 
done
</code></pre>

<p>This will return all information on the volumes. For the ID you can change the <code>describe-volumes</code> line to:</p>

<pre><code>aws ec2 describe-volumes --filters Name=encrypted,Values=false Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[].Attachments[].VolumeId"
</code></pre>

CC BY-SA 3.0
2017-05-18T19:38:35.847Z
2017-05-18T19:38:35.847Z
Alex Baily
<p>This can be done using the AWS CLI:</p>

<pre><code>aws ec2 describe-volumes --query Volumes[*].VolumeId --filters Name=encrypted,Values=true
</code></pre>

CC BY-SA 4.0
2020-03-11T20:41:43.603Z
2020-03-12T08:09:38.543Z
2020-03-12T08:09:38.543Z
Erick Douglas Lima
<p>Below presented there are is a Bash script functions based on <code>awscli</code> to get <strong>AWS EBS volumes encryption state</strong> for different scenarios</p>

<p><strong>NOTE1:</strong> your IAM Profile and that is currently running</p>

<p>source public github gist: <a href="https://gist.github.com/exequielrafaela/4cce5cf7198d5f239153e339587ab392" rel="nofollow noreferrer">https://gist.github.com/exequielrafaela/4cce5cf7198d5f239153e339587ab392</a></p>

<p><strong>NOTE2:</strong> You'll find other bash scripts for some usual Sec &amp; Audit validations.</p>

<pre><code>#!/bin/bash

#
# Bash script functions based on awscli to get AWS EBS volumes encryption state for different scenarios
# your IAM Profile and that is currently running
#

#
# Your AWS IAM profile here (~/.aws/credentials &amp; ~/.aws/config).
#
AWS_IAM_PROFILE="your-aws-iam-profile-here"

#
# AWS EBS status -&gt; attached || deattached
#
AWS_EBS_ATTACHMENT_STATUS="attached"


#=========================================#
# Functions                               #
#=========================================#
func_aws_ec2_ebs_list_encrypted(){
    #
    # Get all running AWS EC2 accessible via your ${AWS_IAM_PROFILE} role.
    #
    instances=`aws ec2 describe-instances --region us-east-1 \
    --filters Name=instance-state-name,Values=running \
    --query "Reservations[*].Instances[0].InstanceId" \
    --output text \
    --profile ${AWS_IAM_PROFILE}`

    #
    # Iterate over the Instances list and present:
    # echo "${instance} $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted"
    # eg: i-111111111111111 Jenkins Volumes: 2 VolumeId: vol-111111111111111 Encrypted: false
    #
    echo "#===============================================#"
    echo "# EBS Volumes attached to running EC2 Instances #"
    echo "#===============================================#"
    for instance in ${instances};
    do
      count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
      --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
      --query "Volumes[]"  | jq  -r '. | length';`

      name=`aws ec2 describe-tags --profile ${AWS_IAM_PROFILE} \
      --filters Name=resource-id,Values=${instance} Name=key,Values=Name \
      --query Tags[].Value | jq -r '.[0]'`

      if [[ ${count} -gt 0 ]]; then
        START=0
        END=${count}
        for ((i=START; i&lt;END; i++))
        do
           #echo "i: $i"
           encrypted=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
           --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
           --query "Volumes[]"  | jq  -r ".[$i].Encrypted";`

           volumeid=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
           --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
           --query "Volumes[]"  | jq  -r ".[$i].VolumeId";`

           echo "EC2: ${instance} $name Volumes: $count EbsVolumeId: $volumeid Encrypted: $encrypted "
        done
      fi
    done
}

func_aws_ebs_list_encrypted(){
    echo ""
    echo "#==============================================#"
    echo "# All EBS Volumes                              #"
    echo "#==============================================#"
    ebs_count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
    --query "Volumes[]"  | jq ".[].VolumeId | length" | wc -l`

    echo "N° AWS EBS VOLUMES: ${ebs_count}"
    echo ""

    if [[ ${ebs_count} -gt 0 ]]; then
    START=0
    END=${ebs_count}
    for ((i=START; i&lt;END; i++))
    do
       #echo "i: $i"
        ebs_volumeid=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
        --query "Volumes[]"  | jq -r ".[$i].VolumeId"`

        ebs_encrypted=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
        --query "Volumes[]"  | jq -r ".[$i].Encrypted"`

       echo "EbsVolumeId: ${ebs_volumeid} Encrypted: ${ebs_encrypted}"
    done
    fi
}

#=========================================#
# Main() - Function calls                 #
#=========================================#
func_aws_ec2_ebs_list_encrypted
func_aws_ebs_list_encrypted
</code></pre>

CC BY-SA 4.0
2019-10-27T20:36:05.613Z
2019-10-27T20:36:05.613Z
Exequiel Barrirero
<p>There is a great question here about how to get a <a href="https://devops.stackexchange.com/questions/1169/what-is-the-simplest-way-to-list-which-attached-disks-are-encrypted-and-which-n">list of encrypted disks</a>. I'm currently using the <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html" rel="noreferrer">describe-volumes</a> command. </p>

<p>For the record I'm currently using:</p>

<pre><code>aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=false Name=attachment.status,Values=attached --query "length(Volumes[])"
</code></pre>

<p>What I want is to filter that down further to just the instances that are running. (ie exclude the ones that are stopped). </p>

<p>My question is: <strong>How can I get a list of encrypted disks for instances that are running on the AWS CLI?</strong></p>

CC BY-SA 3.0
2017-05-17T20:27:38.153Z
Did you try something from the aws cli docs?  Mabye from aws ec2 describe-instances?
Tensibai
CC BY-SA 3.0
2017-05-18T10:26:27.200Z
...maybe integrate some munged output from a separate inline run of `$(aws ec2 describe-instances ...)` into this command?
Michael - sqlbot
CC BY-SA 3.0
2017-05-18T11:35:43.463Z
Could you expand on how you'd do that?
hawkeye
<amazon-ec2><encryption><aws-cli>
How can I get a list of encrypted disks for instances that are running on the AWS CLI?
hawkeye
# How can I get a list of encrypted disks for instances that are running on the AWS CLI?

(Asked by: username_0 on 2017-05-17)

There is a great question here about how to get a list of encrypted disks. I'm currently using the describe-volumes command. 
For the record I'm currently using:
aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=false Name=attachment.status,Values=attached --query "length(Volumes[])"

What I want is to filter that down further to just the instances that are running. (ie exclude the ones that are stopped). 
My question is: How can I get a list of encrypted disks for instances that are running on the AWS CLI?

**Tags:** amazon-ec2, encryption, aws-cli

> **Comments:**
> **username_1**: Did you try something from the aws cli docs?  Mabye from aws ec2 describe-instances?  
> **username_2**: ...maybe integrate some munged output from a separate inline run of `$(aws ec2 describe-instances ...)` into this command?  
> **username_0**: Could you expand on how you'd do that?  

---

## 4 answers

### Answer by username_0 on 2017-05-22. Score: 2 | Accepted answer

Here is what I ended up using. Enjoy. 
for instance in $instances;
do
  count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r '. | length';`
  name=`aws ec2 describe-tags --filters Name=resource-id,Values=$instance Name=key,Values=Name --query Tags[].Value | jq -r '.[0]'`
  if [ $count -gt 0 ]; then
    START=0
    END=$count
    for ((i=START; i


---

### Answer by username_3 on 2017-05-18. Score: 1

I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output:
instances=`aws ec2 describe-instances --region us-east-1 --filters Name=instance-state-name,Values=running --query "Reservations[*].Instances[0].InstanceId" --output text`

for instance in $instances; 
do  
   aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=true Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"; 
done

This will return all information on the volumes. For the ID you can change the describe-volumes line to:
aws ec2 describe-volumes --filters Name=encrypted,Values=false Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[].Attachments[].VolumeId"


---

### Answer by username_4 on 2020-03-11. Score: 0

This can be done using the AWS CLI:
aws ec2 describe-volumes --query Volumes[*].VolumeId --filters Name=encrypted,Values=true


---

### Answer by username_5 on 2019-10-27. Score: 0

Below presented there are is a Bash script functions based on awscli to get AWS EBS volumes encryption state for different scenarios
NOTE1: your IAM Profile and that is currently running
source public github gist: https://gist.github.com/exequielrafaela/4cce5cf7198d5f239153e339587ab392
NOTE2: You'll find other bash scripts for some usual Sec & Audit validations.
#!/bin/bash

#
# Bash script functions based on awscli to get AWS EBS volumes encryption state for different scenarios
# your IAM Profile and that is currently running
#

#
# Your AWS IAM profile here (~/.aws/credentials & ~/.aws/config).
#
AWS_IAM_PROFILE="your-aws-iam-profile-here"

#
# AWS EBS status -> attached || deattached
#
AWS_EBS_ATTACHMENT_STATUS="attached"


#=========================================#
# Functions                               #
#=========================================#
func_aws_ec2_ebs_list_encrypted(){
    #
    # Get all running AWS EC2 accessible via your ${AWS_IAM_PROFILE} role.
    #
    instances=`aws ec2 describe-instances --region us-east-1 \
    --filters Name=instance-state-name,Values=running \
    --query "Reservations[*].Instances[0].InstanceId" \
    --output text \
    --profile ${AWS_IAM_PROFILE}`

    #
    # Iterate over the Instances list and present:
    # echo "${instance} $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted"
    # eg: i-111111111111111 Jenkins Volumes: 2 VolumeId: vol-111111111111111 Encrypted: false
    #
    echo "#===============================================#"
    echo "# EBS Volumes attached to running EC2 Instances #"
    echo "#===============================================#"
    for instance in ${instances};
    do
      count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
      --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
      --query "Volumes[]"  | jq  -r '. | length';`

      name=`aws ec2 describe-tags --profile ${AWS_IAM_PROFILE} \
      --filters Name=resource-id,Values=${instance} Name=key,Values=Name \
      --query Tags[].Value | jq -r '.[0]'`

      if [[ ${count} -gt 0 ]]; then
        START=0
        END=${count}
        for ((i=START; i


---

