Table: aws_ebs_volume - Query AWS Elastic Block Store (EBS) using SQL
The AWS Elastic Block Store (EBS) is a high-performance block storage service designed for use with Amazon Elastic Compute Cloud (EC2) for both throughput and transaction intensive workloads at any scale. It provides persistent block-level storage volumes for use with Amazon EC2 instances. EBS volumes are highly available and reliable storage volumes that can be attached to any running instance and used like a physical hard drive.
Table Usage Guide
The aws_ebs_volume
table in Steampipe provides you with information about volumes within AWS Elastic Block Store (EBS). This table allows you, as a DevOps engineer, to query volume-specific details, including size, state, type, and associated metadata. You can utilize this table to gather insights on volumes, such as their encryption status, IOPS performance, and snapshot details. The schema outlines the various attributes of the EBS volume for you, including the volume ID, creation time, attached instances, and associated tags.
Examples
List of unencrypted EBS volumes
Identify instances where EBS volumes in your AWS environment are not encrypted. This is crucial for security audits and ensuring compliance with data protection policies.
select volume_id, encryptedfrom aws_ebs_volumewhere not encrypted;
select volume_id, encryptedfrom aws_ebs_volumewhere encrypted = 0;
List of unattached EBS volumes
Identify instances where EBS volumes in AWS are not attached to any instances. This could help in optimizing resource usage and managing costs by removing unnecessary volumes.
select volume_id, volume_typefrom aws_ebs_volumewhere jsonb_array_length(attachments) = 0;
select volume_id, volume_typefrom aws_ebs_volumewhere json_array_length(attachments) = 0;
List of Provisioned IOPS SSD (io1) volumes
Determine the areas in which Provisioned IOPS SSD (io1) volumes are being used in your AWS infrastructure. This information can help optimize storage performance and costs by identifying potential areas for volume type adjustment.
select volume_id, volume_typefrom aws_ebs_volumewhere volume_type = 'io1';
select volume_id, volume_typefrom aws_ebs_volumewhere volume_type = 'io1';
List of EBS volumes with size more than 100GiB
Identify instances where AWS EBS volumes exceed 100GiB in size. This is useful to manage storage resources and prevent excessive usage.
select volume_id, sizefrom aws_ebs_volumewhere size > '100';
select volume_id, sizefrom aws_ebs_volumewhere size > 100;
Count the number of EBS volumes by volume type
Identify the distribution of different types of EBS volumes in your AWS environment. This helps in understanding the usage patterns and planning for cost optimization.
select volume_type, count(volume_type) as countfrom aws_ebs_volumegroup by volume_type;
select volume_type, count(volume_type) as countfrom aws_ebs_volumegroup by volume_type;
Find EBS Volumes Attached To Stopped EC2 Instances
Discover the segments that include EBS volumes attached to EC2 instances that are currently in a stopped state. This information can be beneficial to optimize resource allocation and reduce unnecessary costs.
select volume_id, size, att ->> 'InstanceId' as instance_idfrom aws_ebs_volume cross join jsonb_array_elements(attachments) as att join aws_ec2_instance as i on i.instance_id = att ->> 'InstanceId'where instance_state = 'stopped';
select volume_id, size, json_extract(att.value, '$.InstanceId') as instance_idfrom aws_ebs_volume join json_each(attachments) as att join aws_ec2_instance as i on i.instance_id = json_extract(att.value, '$.InstanceId')where instance_state = 'stopped';
List of Provisioned IOPS SSD (io1) volumes
Identify instances where the SSD volumes with provisioned IOPS (IO1) are being used. This could be beneficial for performance optimization and cost management.
select volume_id, volume_typefrom aws_ebs_volumewhere volume_type = 'io1';
select volume_id, volume_typefrom aws_ebs_volumewhere volume_type = 'io1';
Query examples
- ebs_volume_1_year_count
- ebs_volume_24_hours_count
- ebs_volume_30_90_days_count
- ebs_volume_30_days_count
- ebs_volume_90_365_days_count
- ebs_volume_age_table
- ebs_volume_attached_instances
- ebs_volume_attached_instances_count
- ebs_volume_by_account
- ebs_volume_by_creation_month
- ebs_volume_by_region
- ebs_volume_by_state
- ebs_volume_by_type
- ebs_volume_count
- ebs_volume_encryption
- ebs_volume_encryption_table
- ebs_volume_input
- ebs_volume_iops
- ebs_volume_overview
- ebs_volume_state
- ebs_volume_storage
- ebs_volume_storage_by_account
- ebs_volume_storage_by_creation_month
- ebs_volume_storage_by_region
- ebs_volume_storage_by_type
- ebs_volume_storage_total
- ebs_volume_tags
- ebs_volume_type
- ebs_volume_unattached_count
- ebs_volume_unencrypted_count
- ebs_volumes_for_ec2_instance
- ebs_volumes_for_kms_key
- ec2_amis_for_ebs_volume
- ec2_instance_block_device_mapping
- ec2_instances_for_ebs_volume
- kms_keys_for_ebs_volume
- source_ebs_snapshots_for_ebs_volume
- source_ebs_volumes_for_ebs_snapshot
- target_ebs_snapshots_for_ebs_volume
- target_ebs_volumes_for_ebs_snapshot
Control examples
- All Controls > EBS > EBS volume snapshots should exist
- All Controls > ECS > ECS clusters encryption at rest should be enabled
- Attached EBS volumes should have delete on termination enabled
- Attached EBS volumes should have encryption enabled
- AWS Foundational Security Best Practices > EC2 > 3 Attached EBS volumes should be encrypted at rest
- CIS AWS Compute Services Benchmark v1.0.0 > 2 Elastic Cloud Compute (EC2) > 2.2 Elastic Block Storage (EBS) > 2.2.1 Ensure EBS volume encryption is enabled
- CIS AWS Compute Services Benchmark v1.0.0 > 2 Elastic Cloud Compute (EC2) > 2.2 Elastic Block Storage (EBS) > 2.2.4 Ensure unused EBS volumes are removed
- CIS v1.3.0 > 2 Storage > 2.2 Elastic Compute Cloud (EC2) > 2.2.1 Ensure EBS volume encryption is enabled
- CIS v1.4.0 > 2 Storage > 2.2 Elastic Compute Cloud (EC2) > 2.2.1 Ensure EBS volume encryption is enabled
- CIS v1.5.0 > 2 Storage > 2.2 Elastic Compute Cloud (EC2) > 2.2.1 Ensure EBS Volume Encryption is Enabled in all Regions
- CIS v2.0.0 > 2 Storage > 2.2 Elastic Compute Cloud (EC2) > 2.2.1 Ensure EBS Volume Encryption is Enabled in all Regions
- CIS v3.0.0 > 2 Storage > 2.2 Elastic Compute Cloud (EC2) > 2.2.1 Ensure EBS Volume Encryption is Enabled in all Regions
- EBS volume encryption at rest should be enabled
- EBS volumes should be attached to EC2 instances
- EBS volumes should be in a backup plan
- EBS volumes should be protected by a backup plan
Schema for aws_ebs_volume
Name | Type | Operators | Description |
---|---|---|---|
_ctx | jsonb | Steampipe context in JSON form. | |
account_id | text | =, !=, ~~, ~~*, !~~, !~~* | The AWS Account ID in which the resource is located. |
akas | jsonb | Array of globally unique identifier strings (also known as) for the resource. | |
arn | text | The Amazon Resource Name (ARN) specifying the volume. | |
attachments | jsonb | Information about the volume attachments. | |
auto_enable_io | boolean | The state of autoEnableIO attribute. | |
availability_zone | text | = | The Availability Zone for the volume. |
create_time | timestamp with time zone | The time stamp when volume creation was initiated. | |
encrypted | boolean | =, != | Indicates whether the volume is encrypted. |
fast_restored | boolean | =, != | Indicates whether the volume was created using fast snapshot restore. |
iops | bigint | The number of I/O operations per second (IOPS) that the volume supports. | |
kms_key_id | text | The Amazon Resource Name (ARN) of the AWS Key Management Service (AWS KMS) customer master key (CMK) that was used to protect the volume encryption key for the volume. | |
multi_attach_enabled | boolean | =, != | Indicates whether Amazon EBS Multi-Attach is enabled. |
outpost_arn | text | The Amazon Resource Name (ARN) of the Outpost. | |
partition | text | The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov). | |
product_codes | jsonb | A list of product codes. | |
region | text | The AWS Region in which the resource is located. | |
size | bigint | = | The size of the volume, in GiBs. |
snapshot_id | text | = | The snapshot from which the volume was created, if applicable. |
sp_connection_name | text | =, !=, ~~, ~~*, !~~, !~~* | Steampipe connection name. |
sp_ctx | jsonb | Steampipe context in JSON form. | |
state | text | = | The volume state. |
tags | jsonb | A map of tags for the resource. | |
tags_src | jsonb | A list of tags assigned to the volume. | |
throughput | bigint | The throughput that the volume supports, in MiB/s.. | |
title | text | Title of the resource. | |
volume_id | text | = | The ID of the volume. |
volume_type | text | = | The volume type. This can be gp2 for General Purpose SSD, io1 or io2 for Provisioned IOPS SSD, st1 for Throughput Optimized HDD, sc1 for Cold HDD, or standard for Magnetic volumes. |
Export
This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.
You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh
script:
/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws
You can pass the configuration to the command with the --config
argument:
steampipe_export_aws --config '<your_config>' aws_ebs_volume