An account administrator enables the "Always encrypt new EBS volumes" (EBS encryption by default) setting in a Region, hoping this will secure the account's existing unencrypted volumes and snapshots too. What actually happens?
- The setting immediately re-encrypts every existing unencrypted volume and snapshot in that Region in the background
- The setting only applies going forward: newly created volumes and snapshots in that Region are encrypted automatically, but volumes and snapshots that already existed before the setting was enabled remain unencrypted unless the administrator explicitly migrates them
- The setting applies retroactively to existing volumes but not to existing snapshots
- The setting has no effect on snapshots at all in any case, only on volumes
Why B? And why not the others?
Correct answer: B. The setting only applies going forward: newly created volumes and snapshots in that Region are encrypted automatically, but volumes and snapshots that already existed before the setting was enabled remain unencrypted unless the administrator explicitly migrates them
EBS encryption by default is an account-and-Region-level setting that only changes behavior for resources created after it's turned on: once enabled, every newly created EBS volume and every new snapshot copy in that Region is automatically encrypted, but volumes and snapshots that already existed before the setting was enabled remain exactly as they were, unencrypted, until the administrator takes a separate, explicit action such as creating an encrypted snapshot copy of an existing volume and building a new encrypted volume from it. The option claiming existing resources are automatically re-encrypted in the background describes a retroactive migration this setting does not perform. The option claiming it applies to existing volumes but not existing snapshots invents an inconsistency that doesn't exist: the setting is forward-looking for both resource types equally, exempting neither existing volumes nor existing snapshots. The option claiming the setting never affects snapshots at all is also wrong, since new snapshots created after the setting is enabled are covered by it, just not retroactively for anything that already existed beforehand.
Source: AWS EBS documentation: Amazon EBS encryption — encryption by default