EBS volumes that back a computer-aided dispatch (CAD) database must…

Question

EBS volumes that back a computer-aided dispatch (CAD) database must be encrypted at rest, and the account should prefer encryption by default for new volumes. Which design best enforces encrypted block storage for that sensitive workload?

Accepted Answer

Enable EBS encryption by default for the account/Region and launch the CAD database on encrypted EBS volumes (with IAM/guardrail support as needed) — CAD disks should arrive already locked: turn on EBS encryption by default and run the database on encrypted volumes. Sticky notes that say “encrypted” on a security group do not encrypt a block device.

Answer

Use unencrypted gp3 volumes and copy database files to an unencrypted public S3 bucket hourly

Answer

Disable volume encryption because encrypted EBS cannot be snapshotted under any account setting

Answer

Rely on security group descriptions that include the word encrypted without enabling EBS encryption

EBS volumes that back a computer-aided dispatch (CAD) database must be encrypted at rest, and the account should prefer encryption by default for new volumes. Which design best enforces encrypted block storage for that sensitive workload?

Short Explanation

Full Explanation