Answers: <p>Here is what I ended up using. Enjoy. </p>
  
  <pre><code>for instance in $instances;
  do
    count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r '. | length';`
    name=`aws ec2 describe-tags --filters Name=resource-id,Values=$instance Name=key,Values=Name --query Tags[].Value | jq -r '.[0]'`
    if [ $count -gt 0 ]; then
      START=0
      END=$count
      for ((i=START; i&lt;END; i++))
      do
         #echo "i: $i"
         encrypted=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r ".[$i].Encrypted";`
         volumeid=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r ".[$i].VolumeId";`
         echo "$instance $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted "
      done
    fi
  done
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-22T11:47:20.967Z
Answers: 2017-05-22T11:47:20.967Z
Answers: hawkeye
Answers: <p>I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output:</p>
  
  <pre><code>instances=`aws ec2 describe-instances --region us-east-1 --filters Name=instance-state-name,Values=running --query "Reservations[*].Instances[0].InstanceId" --output text`
  
  for instance in $instances; 
  do  
     aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=true Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"; 
  done
  </code></pre>
  
  <p>This will return all information on the volumes. For the ID you can change the <code>describe-volumes</code> line to:</p>
  
  <pre><code>aws ec2 describe-volumes --filters Name=encrypted,Values=false Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[].Attachments[].VolumeId"
  </code></pre>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-18T19:38:35.847Z
Answers: 2017-05-18T19:38:35.847Z
Answers: Alex Baily
Answers: <p>This can be done using the AWS CLI:</p>
  
  <pre><code>aws ec2 describe-volumes --query Volumes[*].VolumeId --filters Name=encrypted,Values=true
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-03-11T20:41:43.603Z
Answers: 2020-03-12T08:09:38.543Z
Answers: 2020-03-12T08:09:38.543Z
Answers: Erick Douglas Lima
Answers: <p>Below presented there are is a Bash script functions based on <code>awscli</code> to get <strong>AWS EBS volumes encryption state</strong> for different scenarios</p>
  
  <p><strong>NOTE1:</strong> your IAM Profile and that is currently running</p>
  
  <p>source public github gist: <a href="https://gist.github.com/exequielrafaela/4cce5cf7198d5f239153e339587ab392" rel="nofollow noreferrer">https://gist.github.com/exequielrafaela/4cce5cf7198d5f239153e339587ab392</a></p>
  
  <p><strong>NOTE2:</strong> You'll find other bash scripts for some usual Sec &amp; Audit validations.</p>
  
  <pre><code>#!/bin/bash
  
  #
  # Bash script functions based on awscli to get AWS EBS volumes encryption state for different scenarios
  # your IAM Profile and that is currently running
  #
  
  #
  # Your AWS IAM profile here (~/.aws/credentials &amp; ~/.aws/config).
  #
  AWS_IAM_PROFILE="your-aws-iam-profile-here"
  
  #
  # AWS EBS status -&gt; attached || deattached
  #
  AWS_EBS_ATTACHMENT_STATUS="attached"
  
  
  #=========================================#
  # Functions                               #
  #=========================================#
  func_aws_ec2_ebs_list_encrypted(){
      #
      # Get all running AWS EC2 accessible via your ${AWS_IAM_PROFILE} role.
      #
      instances=`aws ec2 describe-instances --region us-east-1 \
      --filters Name=instance-state-name,Values=running \
      --query "Reservations[*].Instances[0].InstanceId" \
      --output text \
      --profile ${AWS_IAM_PROFILE}`
  
      #
      # Iterate over the Instances list and present:
      # echo "${instance} $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted"
      # eg: i-111111111111111 Jenkins Volumes: 2 VolumeId: vol-111111111111111 Encrypted: false
      #
      echo "#===============================================#"
      echo "# EBS Volumes attached to running EC2 Instances #"
      echo "#===============================================#"
      for instance in ${instances};
      do
        count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
        --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
        --query "Volumes[]"  | jq  -r '. | length';`
  
        name=`aws ec2 describe-tags --profile ${AWS_IAM_PROFILE} \
        --filters Name=resource-id,Values=${instance} Name=key,Values=Name \
        --query Tags[].Value | jq -r '.[0]'`
  
        if [[ ${count} -gt 0 ]]; then
          START=0
          END=${count}
          for ((i=START; i&lt;END; i++))
          do
             #echo "i: $i"
             encrypted=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
             --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
             --query "Volumes[]"  | jq  -r ".[$i].Encrypted";`
  
             volumeid=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
             --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
             --query "Volumes[]"  | jq  -r ".[$i].VolumeId";`
  
             echo "EC2: ${instance} $name Volumes: $count EbsVolumeId: $volumeid Encrypted: $encrypted "
          done
        fi
      done
  }
  
  func_aws_ebs_list_encrypted(){
      echo ""
      echo "#==============================================#"
      echo "# All EBS Volumes                              #"
      echo "#==============================================#"
      ebs_count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
      --query "Volumes[]"  | jq ".[].VolumeId | length" | wc -l`
  
      echo "N° AWS EBS VOLUMES: ${ebs_count}"
      echo ""
  
      if [[ ${ebs_count} -gt 0 ]]; then
      START=0
      END=${ebs_count}
      for ((i=START; i&lt;END; i++))
      do
         #echo "i: $i"
          ebs_volumeid=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
          --query "Volumes[]"  | jq -r ".[$i].VolumeId"`
  
          ebs_encrypted=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
          --query "Volumes[]"  | jq -r ".[$i].Encrypted"`
  
         echo "EbsVolumeId: ${ebs_volumeid} Encrypted: ${ebs_encrypted}"
      done
      fi
  }
  
  #=========================================#
  # Main() - Function calls                 #
  #=========================================#
  func_aws_ec2_ebs_list_encrypted
  func_aws_ebs_list_encrypted
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-10-27T20:36:05.613Z
Answers: 2019-10-27T20:36:05.613Z
Answers: Exequiel Barrirero
Body: <p>There is a great question here about how to get a <a href="https://devops.stackexchange.com/questions/1169/what-is-the-simplest-way-to-list-which-attached-disks-are-encrypted-and-which-n">list of encrypted disks</a>. I'm currently using the <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html" rel="noreferrer">describe-volumes</a> command. </p>
  
  <p>For the record I'm currently using:</p>
  
  <pre><code>aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=false Name=attachment.status,Values=attached --query "length(Volumes[])"
  </code></pre>
  
  <p>What I want is to filter that down further to just the instances that are running. (ie exclude the ones that are stopped). </p>
  
  <p>My question is: <strong>How can I get a list of encrypted disks for instances that are running on the AWS CLI?</strong></p>
  
Comments: CC BY-SA 3.0
Comments: 2017-05-17T20:27:38.153Z
Comments: Did you try something from the aws cli docs?  Mabye from aws ec2 describe-instances?
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2017-05-18T10:26:27.200Z
Comments: ...maybe integrate some munged output from a separate inline run of `$(aws ec2 describe-instances ...)` into this command?
Comments: Michael - sqlbot
Comments: CC BY-SA 3.0
Comments: 2017-05-18T11:35:43.463Z
Comments: Could you expand on how you'd do that?
Comments: hawkeye
Tags: <amazon-ec2><encryption><aws-cli>
Title: How can I get a list of encrypted disks for instances that are running on the AWS CLI?
UserDisplayName: hawkeye
ThreadText: # How can I get a list of encrypted disks for instances that are running on the AWS CLI?
  
  (Asked by: username_0 on 2017-05-17)
  
  There is a great question here about how to get a [list of encrypted disks](https://devops.stackexchange.com/questions/1169/what-is-the-simplest-way-to-list-which-attached-disks-are-encrypted-and-which-n). I'm currently using the [describe-volumes](http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html) command.
  
  For the record I'm currently using:
  
  ```
  aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=false Name=attachment.status,Values=attached --query "length(Volumes[])"
  
  ```
  
  What I want is to filter that down further to just the instances that are running. (ie exclude the ones that are stopped).
  
  My question is: **How can I get a list of encrypted disks for instances that are running on the AWS CLI?**
  
  **Tags:** amazon-ec2, encryption, aws-cli
  
  > **Comments:**
  > **username_1**: Did you try something from the aws cli docs?  Mabye from aws ec2 describe-instances?  
  > **username_2**: ...maybe integrate some munged output from a separate inline run of `$(aws ec2 describe-instances ...)` into this command?  
  > **username_0**: Could you expand on how you'd do that?  
  
  ---
  
  ## 4 answers
  
  ### Answer by username_0 on 2017-05-22. Score: 2 | Accepted answer
  
  Here is what I ended up using. Enjoy.
  
  ```
  for instance in $instances;
  do
    count=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r '. | length';`
    name=`aws ec2 describe-tags --filters Name=resource-id,Values=$instance Name=key,Values=Name --query Tags[].Value | jq -r '.[0]'`
    if [ $count -gt 0 ]; then
      START=0
      END=$count
      for ((i=START; i<END; i++))
      do
         #echo "i: $i"
         encrypted=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r ".[$i].Encrypted";`
         volumeid=`aws ec2 describe-volumes --filters Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"  | jq  -r ".[$i].VolumeId";`
         echo "$instance $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted "
      done
    fi
  done
  
  ```
  
  
  ---
  
  ### Answer by username_3 on 2017-05-18. Score: 1
  
  I'm not sure if you can do this without a loop. But you should be able to run the below in bash and get the right output:
  
  ```
  instances=`aws ec2 describe-instances --region us-east-1 --filters Name=instance-state-name,Values=running --query "Reservations[*].Instances[0].InstanceId" --output text`
  
  for instance in $instances; 
  do  
     aws ec2 describe-volumes --region us-east-1 --filters Name=encrypted,Values=true Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[]"; 
  done
  
  ```
  
  This will return all information on the volumes. For the ID you can change the `describe-volumes` line to:
  
  ```
  aws ec2 describe-volumes --filters Name=encrypted,Values=false Name=attachment.status,Values=attached Name=attachment.instance-id,Values=$instance --query "Volumes[].Attachments[].VolumeId"
  
  ```
  
  
  ---
  
  ### Answer by username_4 on 2020-03-11. Score: 0
  
  This can be done using the AWS CLI:
  
  ```
  aws ec2 describe-volumes --query Volumes[*].VolumeId --filters Name=encrypted,Values=true
  
  ```
  
  
  ---
  
  ### Answer by username_5 on 2019-10-27. Score: 0
  
  Below presented there are is a Bash script functions based on `awscli` to get **AWS EBS volumes encryption state** for different scenarios
  
  **NOTE1:** your IAM Profile and that is currently running
  
  source public github gist: <https://gist.github.com/exequielrafaela/4cce5cf7198d5f239153e339587ab392>
  
  **NOTE2:** You'll find other bash scripts for some usual Sec & Audit validations.
  
  ```
  #!/bin/bash
  
  #
  # Bash script functions based on awscli to get AWS EBS volumes encryption state for different scenarios
  # your IAM Profile and that is currently running
  #
  
  #
  # Your AWS IAM profile here (~/.aws/credentials & ~/.aws/config).
  #
  AWS_IAM_PROFILE="your-aws-iam-profile-here"
  
  #
  # AWS EBS status -> attached || deattached
  #
  AWS_EBS_ATTACHMENT_STATUS="attached"
  
  #=========================================#
  # Functions                               #
  #=========================================#
  func_aws_ec2_ebs_list_encrypted(){
      #
      # Get all running AWS EC2 accessible via your ${AWS_IAM_PROFILE} role.
      #
      instances=`aws ec2 describe-instances --region us-east-1 \
      --filters Name=instance-state-name,Values=running \
      --query "Reservations[*].Instances[0].InstanceId" \
      --output text \
      --profile ${AWS_IAM_PROFILE}`
  
      #
      # Iterate over the Instances list and present:
      # echo "${instance} $name Volumes: $count VolumeId: $volumeid Encrypted: $encrypted"
      # eg: i-111111111111111 Jenkins Volumes: 2 VolumeId: vol-111111111111111 Encrypted: false
      #
      echo "#===============================================#"
      echo "# EBS Volumes attached to running EC2 Instances #"
      echo "#===============================================#"
      for instance in ${instances};
      do
        count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
        --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
        --query "Volumes[]"  | jq  -r '. | length';`
  
        name=`aws ec2 describe-tags --profile ${AWS_IAM_PROFILE} \
        --filters Name=resource-id,Values=${instance} Name=key,Values=Name \
        --query Tags[].Value | jq -r '.[0]'`
  
        if [[ ${count} -gt 0 ]]; then
          START=0
          END=${count}
          for ((i=START; i<END; i++))
          do
             #echo "i: $i"
             encrypted=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
             --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
             --query "Volumes[]"  | jq  -r ".[$i].Encrypted";`
  
             volumeid=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
             --filters Name=attachment.status,Values=${AWS_EBS_ATTACHMENT_STATUS} Name=attachment.instance-id,Values=${instance} \
             --query "Volumes[]"  | jq  -r ".[$i].VolumeId";`
  
             echo "EC2: ${instance} $name Volumes: $count EbsVolumeId: $volumeid Encrypted: $encrypted "
          done
        fi
      done
  }
  
  func_aws_ebs_list_encrypted(){
      echo ""
      echo "#==============================================#"
      echo "# All EBS Volumes                              #"
      echo "#==============================================#"
      ebs_count=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
      --query "Volumes[]"  | jq ".[].VolumeId | length" | wc -l`
  
      echo "N° AWS EBS VOLUMES: ${ebs_count}"
      echo ""
  
      if [[ ${ebs_count} -gt 0 ]]; then
      START=0
      END=${ebs_count}
      for ((i=START; i<END; i++))
      do
         #echo "i: $i"
          ebs_volumeid=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
          --query "Volumes[]"  | jq -r ".[$i].VolumeId"`
  
          ebs_encrypted=`aws ec2 describe-volumes --profile ${AWS_IAM_PROFILE} \
          --query "Volumes[]"  | jq -r ".[$i].Encrypted"`
  
         echo "EbsVolumeId: ${ebs_volumeid} Encrypted: ${ebs_encrypted}"
      done
      fi
  }
  
  #=========================================#
  # Main() - Function calls                 #
  #=========================================#
  func_aws_ec2_ebs_list_encrypted
  func_aws_ebs_list_encrypted
  
  ```
  
  
  ---
  
  