Control: Ensure EBS volumes attached to an EC2 instance is marked for deletion upon instance termination

Description

This rule ensures that Amazon Elastic Block Store volumes that are attached to Amazon Elastic Compute Cloud (Amazon EC2) instances are marked for deletion when an instance is terminated. If an Amazon EBS volume isn't deleted when the instance that it's attached to is terminated, it may violate the concept of least functionality.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.ec2_instance_attached_ebs_volume_delete_on_termination_enabled

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.ec2_instance_attached_ebs_volume_delete_on_termination_enabled --share

SQL

This control uses a named query:

with ebs_volume_with_delete_on_termination_enabled as (
  select
    count(*) as count,
    arn
  from
    aws_ec2_instance,
    jsonb_array_elements(block_device_mappings) as p
  where
    p -> 'Ebs' ->> 'DeleteOnTermination' = 'false'
  group by
    arn
)
select
  i.arn as resource,
  case
    when e.count > 0 then 'alarm'
    else 'ok'
  end as status,
  case
    when e.count > 0 then ' EBS volume(s) attached to ' || title || ' has delete on termination disabled.'
    else ' EBS volume(s) attached to ' || title || ' has delete on termination enabled.'
  end as reason
  
  , region, account_id
from
  aws_ec2_instance as i
  left join ebs_volume_with_delete_on_termination_enabled as e on e.arn = i.arn;

Control: Ensure EBS volumes attached to an EC2 instance is marked for deletion upon instance termination

Description

Usage

SQL

Tags