AWS EC2 EBS Encryption Disabled

AnalysisType: rule
Description: "Identifies disabling of default EBS encryption. Disabling default encryption does not change the encryption status of existing volumes. "
DisplayName: "AWS EC2 EBS Encryption Disabled"
Enabled: true
Filename: aws_ec2_ebs_encryption_disabled.py
Reports:
  MITRE ATT&CK:
    - TA0040:T1486
    - TA0040:T1565
Runbook: Verify this action was intended and if any EBS volumes were created after the change.
Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EBSEncryption.html#encryption-by-default
Severity: Medium
Tests:
  - ExpectedResult: true
    Log:
      awsRegion: us-east-1
      eventName: DisableEbsEncryptionByDefault
      eventSource: ec2.amazonaws.com
      recipientAccountId: "123456789"
      sourceIPAddress: 1.2.3.4
      userAgent: Chrome Browser
    Name: DisableEbsEncryptionByDefault Event
  - ExpectedResult: false
    Log:
      awsRegion: ap-northeast-1
      eventName: DescribeInstanceStatus
      eventSource: ec2.amazonaws.com
      eventTime: "2022-09-25 16:16:37"
      eventType: AwsApiCall
      readOnly: true
      sourceIPAddress: 1.2.3.4
      userAgent: Datadog
    Name: Non Matching Event
DedupPeriodMinutes: 60
LogTypes:
  - AWS.CloudTrail
RuleID: "AWS.EC2.EBS.Encryption.Disabled"
Threshold: 1


# ------ paired body: aws_ec2_ebs_encryption_disabled.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    return (
        event.get("eventSource") == "ec2.amazonaws.com"
        and event.get("eventName") == "DisableEbsEncryptionByDefault"
    )


def title(event):
    return (
        "EC2 EBS Default Encryption was disabled in "
        f"[{event.get('recipientAccountId')}] - "
        f"[{event.get('awsRegion')}]"
    )


def alert_context(event):
    return aws_rule_context(event)