Answers: <p>To get the number of non encrypted volumes you can run this command:</p>
  
  <pre><code>aws ec2 describe-volumes --region &lt;your_region&gt; --filter "Name=encrypted,Values=false" --query "length(Volumes[])"
  </code></pre>
  
  <p><code>length</code> will return the length of the array <code>Volumes</code> flattened by the selection operator <code>[]</code> (more details on <a href="http://jmespath.readthedocs.io/en/latest/specification.html" rel="nofollow noreferrer">JMESPath documentation</a>).<br>
  As we filter the slection for non encrypted volumes (<code>--filter "Name=encrypted,Values=false"</code>) this should allow to demonstrate to the auditor the number is 0 not encrypted volumes.</p>
  
  <p>Same filter can be applied in the console, in the ec2 page, under 'Elastic Block Store' => 'Volumes', type <code>Encrypted : Not Encrypted</code> to filter the view to non encrypted volumes only. you may add <code>Attachment Status : Attached</code> to list only attached volumes.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-16T11:56:21.950Z
Answers: 2017-05-16T11:56:21.950Z
Answers: Tensibai
Answers: <p>According to <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html" rel="nofollow noreferrer">this document</a> you can run command like:</p>
  
  <pre><code>aws ec2 describe-volumes --region us-east-1
  </code></pre>
  
  <p>(feel free to set region you use)
  and search for field in json output, named "encrypted"</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-05-16T11:47:35.343Z
Answers: 2017-05-16T11:47:35.343Z
Answers: Romeo Ninov
Body: <p>An auditor is asking for proof that we've <a href="https://aws.amazon.com/whitepapers/encrypting-data-at-rest/" rel="nofollow noreferrer">encrypted all the disks</a> on our AWS EC2 VPC. I'd like a way to list all the disks and whether they're <a href="http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html" rel="nofollow noreferrer">encrypted</a> or not. </p>
  
  <p>I know I can build a report with the AWS <a href="http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html" rel="nofollow noreferrer">API</a> (or <a href="http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html" rel="nofollow noreferrer">the CLI</a>) - but I was looking for a simpler approach than that, hopefully with the <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/console.html" rel="nofollow noreferrer">console</a>. </p>
  
  <p>My question is: <strong>What is the simplest way to list which attached disks are encrypted (and which not) on AWS?</strong></p>
  
Comments: CC BY-SA 3.0
Comments: 2017-05-16T11:15:51.200Z
Comments: A dirty implementation would be pulling that data from the response of a simple `awscli` descrive-volumes command
Comments: Dawny33
Comments: CC BY-SA 3.0
Comments: 2017-05-16T11:38:55.570Z
Comments: thanks @Dawny33 - could you expand on that? Would it be specific to attached volumes?
Comments: hawkeye
Tags: <amazon-ec2><encryption>
Title: What is the simplest way to list which attached disks are encrypted (and which not) on AWS?
UserDisplayName: hawkeye
ThreadText: # What is the simplest way to list which attached disks are encrypted (and which not) on AWS?
  
  (Asked by: username_0 on 2017-05-16)
  
  An auditor is asking for proof that we've [encrypted all the disks](https://aws.amazon.com/whitepapers/encrypting-data-at-rest/) on our AWS EC2 VPC. I'd like a way to list all the disks and whether they're [encrypted](http://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html) or not.
  
  I know I can build a report with the AWS [API](http://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVolumes.html) (or [the CLI](http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html)) - but I was looking for a simpler approach than that, hopefully with the [console](http://docs.aws.amazon.com/IAM/latest/UserGuide/console.html).
  
  My question is: **What is the simplest way to list which attached disks are encrypted (and which not) on AWS?**
  
  **Tags:** amazon-ec2, encryption
  
  > **Comments:**
  > **username_1**: A dirty implementation would be pulling that data from the response of a simple `awscli` descrive-volumes command  
  > **username_0**: thanks @username_1 - could you expand on that? Would it be specific to attached volumes?  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_2 on 2017-05-16. Score: 2 | Accepted answer
  
  To get the number of non encrypted volumes you can run this command:
  
  ```
  aws ec2 describe-volumes --region <your_region> --filter "Name=encrypted,Values=false" --query "length(Volumes[])"
  
  ```
  
  `length` will return the length of the array `Volumes` flattened by the selection operator `[]` (more details on [JMESPath documentation](http://jmespath.readthedocs.io/en/latest/specification.html)).  
  As we filter the slection for non encrypted volumes (`--filter "Name=encrypted,Values=false"`) this should allow to demonstrate to the auditor the number is 0 not encrypted volumes.
  
  Same filter can be applied in the console, in the ec2 page, under 'Elastic Block Store' => 'Volumes', type `Encrypted : Not Encrypted` to filter the view to non encrypted volumes only. you may add `Attachment Status : Attached` to list only attached volumes.
  
  
  ---
  
  ### Answer by username_3 on 2017-05-16. Score: 0
  
  According to [this document](http://docs.aws.amazon.com/cli/latest/reference/ec2/describe-volumes.html) you can run command like:
  
  ```
  aws ec2 describe-volumes --region us-east-1
  
  ```
  
  (feel free to set region you use)
  and search for field in json output, named "encrypted"
  
  
  ---
  
  