<p>To get the number of non encrypted volumes you can run this command:</p>

<pre><code>aws ec2 describe-volumes --region &lt;your_region&gt; --filter "Name=encrypted,Values=false" --query "length(Volumes[])"
</code></pre>

<p><code>length</code> will return the length of the array <code>Volumes</code> flattened by the selection operator <code>[]</code> (more details on <a href="http://jmespath.readthedocs.io/en/latest/specification.html" rel="nofollow noreferrer">JMESPath documentation</a>).<br>
As we filter the slection for non encrypted volumes (<code>--filter "Name=encrypted,Values=false"</code>) this should allow to demonstrate to the auditor the number is 0 not encrypted volumes.</p>

<p>Same filter can be applied in the console, in the ec2 page, under 'Elastic Block Store' => 'Volumes', type <code>Encrypted : Not Encrypted</code> to filter the view to non encrypted volumes only. you may add <code>Attachment Status : Attached</code> to list only attached volumes.</p>

CC BY-SA 3.0
2017-05-16T11:56:21.950Z
2017-05-16T11:56:21.950Z
Tensibai
<p>According to <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html" rel="nofollow noreferrer">this document</a> you can run command like:</p>

<pre><code>aws ec2 describe-volumes --region us-east-1
</code></pre>

<p>(feel free to set region you use)
and search for field in json output, named "encrypted"</p>

CC BY-SA 3.0
2017-05-16T11:47:35.343Z
2017-05-16T11:47:35.343Z
Romeo Ninov
<p>An auditor is asking for proof that we've <a href="https://aws.amazon.com/whitepapers/encrypting-data-at-rest/" rel="nofollow noreferrer">encrypted all the disks</a> on our AWS EC2 VPC. I'd like a way to list all the disks and whether they're <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html" rel="nofollow noreferrer">encrypted</a> or not. </p>

<p>I know I can build a report with the AWS <a href="http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html" rel="nofollow noreferrer">API</a> (or <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html" rel="nofollow noreferrer">the CLI</a>) - but I was looking for a simpler approach than that, hopefully with the <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/console.html" rel="nofollow noreferrer">console</a>. </p>

<p>My question is: <strong>What is the simplest way to list which attached disks are encrypted (and which not) on AWS?</strong></p>

CC BY-SA 3.0
2017-05-16T11:15:51.200Z
A dirty implementation would be pulling that data from the response of a simple `awscli` descrive-volumes command
Dawny33
CC BY-SA 3.0
2017-05-16T11:38:55.570Z
thanks @Dawny33 - could you expand on that? Would it be specific to attached volumes?
hawkeye
<amazon-ec2><encryption>
What is the simplest way to list which attached disks are encrypted (and which not) on AWS?
hawkeye
# What is the simplest way to list which attached disks are encrypted (and which not) on AWS?

(Asked by: username_0 on 2017-05-16)

An auditor is asking for proof that we've [encrypted all the disks](https://aws.amazon.com/whitepapers/encrypting-data-at-rest/) on our AWS EC2 VPC. I'd like a way to list all the disks and whether they're [encrypted](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html) or not.

I know I can build a report with the AWS [API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html) (or [the CLI](http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html)) - but I was looking for a simpler approach than that, hopefully with the [console](http://docs.aws.amazon.com/IAM/latest/UserGuide/console.html).

My question is: **What is the simplest way to list which attached disks are encrypted (and which not) on AWS?**

**Tags:** amazon-ec2, encryption

> **Comments:**
> **username_1**: A dirty implementation would be pulling that data from the response of a simple `awscli` descrive-volumes command  
> **username_0**: thanks @username_1 - could you expand on that? Would it be specific to attached volumes?  

---

## 2 answers

### Answer by username_2 on 2017-05-16. Score: 2 | Accepted answer

To get the number of non encrypted volumes you can run this command:
aws ec2 describe-volumes --region  --filter "Name=encrypted,Values=false" --query "length(Volumes[])"

length will return the length of the array Volumes flattened by the selection operator [] (more details on JMESPath documentation).
As we filter the slection for non encrypted volumes (--filter "Name=encrypted,Values=false") this should allow to demonstrate to the auditor the number is 0 not encrypted volumes.
Same filter can be applied in the console, in the ec2 page, under 'Elastic Block Store' => 'Volumes', type Encrypted : Not Encrypted to filter the view to non encrypted volumes only. you may add Attachment Status : Attached to list only attached volumes.


---

### Answer by username_3 on 2017-05-16. Score: 0

According to this document you can run command like:
aws ec2 describe-volumes --region us-east-1

(feel free to set region you use)
and search for field in json output, named "encrypted"


---

