AWS Lambda를 통해 암호화 되지 않은 EBS를 정기적으로 감지하는 구성을 만들어 봤습니다.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeVolumes"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": "arn:aws:sns:ap-northeast-2:xxxxxxxxxx"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:*"
        }
    ]
}

import json
import boto3

ec2 = boto3.client('ec2')
sns = boto3.client('sns')

SNS_TOPIC_ARN = 'arn:aws:sns:ap-northeast-2:xxxxxxxxxxx'

def lambda_handler(event, context):
    print("🔍 Checking all EBS volumes for encryption status...")

    unencrypted_volumes = []

    # 모든 EBS 볼륨 조회
    response = ec2.describe_volumes()
    volumes = response['Volumes']

    for volume in volumes:
        volume_id = volume['VolumeId']
        encrypted = volume.get('Encrypted', False)
        print(f"Volume {volume_id} encrypted: {encrypted}")

        if not encrypted:
            unencrypted_volumes.append(volume_id)

    # 알림 전송
    if unencrypted_volumes:
        message = (
            "🔒 다음 EBS 볼륨이 암호화되어 있지 않습니다:\n\n" +
            "\n".join(unencrypted_volumes)
        )
        print(message)

        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject="🚨 Unencrypted EBS Volumes Detected",
            Message=message
        )
    else:
        print("✅ 모든 EBS 볼륨이 암호화되어 있습니다.")

    return {
        'statusCode': 200,
        'body': f"암호화되지 않은 볼륨 개수: {len(unencrypted_volumes)}"
    }

import json
import boto3

ec2 = boto3.client('ec2')
sns = boto3.client('sns')

SNS_TOPIC_ARN = 'arn:aws:sns:ap-northeast-2:xxxxxxxxxxxxx'

def lambda_handler(event, context):
    print("🔍 Checking all EBS volumes for encryption status...")

    unencrypted_volumes = []

    # 모든 EBS 볼륨 조회
    response = ec2.describe_volumes()
    volumes = response['Volumes']

    for volume in volumes:
        volume_id = volume['VolumeId']
        encrypted = volume.get('Encrypted', False)
        print(f"Volume {volume_id} encrypted: {encrypted}")

        if not encrypted:
            unencrypted_volumes.append(volume_id)

    # 알림 전송
    if unencrypted_volumes:
        volume_list = "\n".join([f"- {vid}" for vid in unencrypted_volumes])

        message = f"""
🚨 *Unencrypted EBS Volumes Detected*

The following EBS volumes are **not encrypted**:

{volume_list}

Please review and take necessary action to enable encryption.
AWS Region: ap-northeast-2
Checked by: Lambda - EBS Encryption Scanner
"""
        print(message)

        sns.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject="🚨 Unencrypted EBS Volumes Detected",
            Message=message
        )
    else:
        print("✅ All EBS volumes are encrypted.")

    return {
        'statusCode': 200,
        'body': f"암호화되지 않은 볼륨 개수: {len(unencrypted_volumes)}"
    }