cis-aws-storage-2.4 - Ensure the creation of a new volume
Audits and configures AWS EBS data volumes to separate critical data from root volumes with KMS encryption and disabled delete-on-termination.
Tags
Updated: 2026-09-18Capabilities
What this skill does
- Audit EBS volume configuration status
- Verify EBS volume encryption status
- Disable delete on termination option
- Create new KMS encrypted volumes
- Attach EBS volumes to instances
Inputs
- AWS credentials and IAM permissions
- EC2 instance ID
- AWS KMS key ID or ARN
- EBS volume specifications
Outputs
- Modified instance block device mappings
- Created KMS encrypted EBS volume
- EBS volume attachment status
- AWS Config and CloudTrail reports
Requirements
- AWS CLI or Management Console access
- IAM permissions for EC2 EBS KMS
- Prerequisite control cis-aws-storage-2.1
- Instance and volume same availability zone
