# AWS Config compliance results across the storage services proving customer data is encrypted at rest — S3 buckets with default server-side encryption, EBS volumes encrypted, and RDS storage encrypted, all backed by KMS

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-encryption-at-rest

Recipe id: `config-encryption-at-rest` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-SIN`
- control `sc-28`

## Collection

Kind: `config-rule`

```sh
# encrypted-volumes
aws configservice get-compliance-details-by-config-rule --config-rule-name encrypted-volumes --compliance-types NON_COMPLIANT
# rds-storage-encrypted
aws configservice get-compliance-details-by-config-rule --config-rule-name rds-storage-encrypted --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# encrypted-volumes-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names encrypted-volumes
# rds-storage-encrypted-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names rds-storage-encrypted
# describe-regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output text
# list-accounts
aws organizations list-accounts --query 'Accounts[].Id' --output text
```

## Expected output

Two EvaluationResults arrays; an empty NON_COMPLIANT set from each rule means every evaluated S3 bucket, attached EBS volume, and RDS instance is encrypted at rest. Managed rule identifiers: ENCRYPTED_VOLUMES, RDS_STORAGE_ENCRYPTED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"encrypted-volumes.EvaluationResults","op":"count_eq","value":0,"controls":["sc-28"],"description":"Every attached EBS volume is encrypted."}
- {"field":"rds-storage-encrypted.EvaluationResults","op":"count_eq","value":0,"controls":["sc-28"],"description":"Every RDS instance has encrypted storage."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["sc-28"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"encrypted-volumes-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-28"],"description":"encrypted-volumes has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"encrypted-volumes-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-28"],"description":"encrypted-volumes has a successful evaluation on record."}
- {"field":"rds-storage-encrypted-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-28"],"description":"rds-storage-encrypted has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"rds-storage-encrypted-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-28"],"description":"rds-storage-encrypted has a successful evaluation on record."}

## GovCloud

AWS Config and all three managed rules are available in AWS GovCloud (US); bucket, volume, DB, and KMS key ARNs use partition arn:aws-us-gov

## Notes

These rules prove encryption is present, not which key backs it. Pass ENCRYPTED_VOLUMES and RDS_STORAGE_ENCRYPTED a kmsId/kmsKeyId parameter to additionally assert a specific CMK rather than any key. These three cover the dominant data stores; extend with the analogous rules for DynamoDB (dynamodb-table-encrypted-kms), EFS (efs-encrypted-check), SNS (sns-encrypted-kms), and other services you actually run — the recipe is the pattern, not the exhaustive list. The S3 rule was removed from this recipe: S3 has applied SSE-S3 to every bucket since 5 January 2023 and it cannot be disabled, so s3-bucket-server-side-encryption-enabled cannot fail and proved nothing. ENCRYPTED_VOLUMES sees attached volumes only, leaving detached volumes and every snapshot unproven, and no CMK is asserted — a human names the data stores in scope, confirms each has a rule, and reads key ownership for SC-28 (01), which is not claimed.

## References

- {"title":"AWS Config managed rule: encrypted-volumes","url":"https://docs.aws.amazon.com/config/latest/developerguide/encrypted-volumes.html"}
- {"title":"AWS Config managed rule: rds-storage-encrypted","url":"https://docs.aws.amazon.com/config/latest/developerguide/rds-storage-encrypted.html"}