# EBS Encryption + Snapshot Hygiene Checklist (July 2026)

## Per account × Region

- [ ] `enable-ebs-encryption-by-default`
- [ ] Default KMS key = customer-managed CMK (not only aws/ebs)
- [ ] SCP deny `ec2:DisableEbsEncryptionByDefault`
- [ ] Block public access for EBS snapshots (prefer block all)
- [ ] Config/Security Hub: ebs-snapshot-block-public-access

## Lifecycle

- [ ] CMK auto-rotation on
- [ ] Key deletion window ≥ 30 days; alarm on ScheduleKeyDeletion
- [ ] Unencrypted legacy volumes: snapshot → encrypted copy → restore/swap backlog

## Counter-case

Default encryption does **not** encrypt existing volumes or unencrypted snapshot copies unless you pass `--encrypted`.