Encrypted EBS Volumes with Snapshot Lifecycle
Volumes that are always encrypted, optional attachment, and a DLM snapshot schedule in the same module - because a volume with no schedule is one copy of your data on hardware that can fail, and leaving snapshots to somebody else usually means nobody.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan pending (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "ebs_volume" {
source = "www.iac-bazaar.com/iac-bazaar/aws-ebs-volume/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-ebs-volume
EBS volumes - always encrypted - with optional attachment and a DLM snapshot
schedule. Works with Terraform and OpenTofu (>= 1.6), AWS provider
>= 6.0, < 7.0.
Two opinions built in:
- Encryption is not an option, it is always on. An unencrypted volume cannot be encrypted in place: it has to be snapshotted, copied with encryption and replaced, while something is using it. Making it a flag invites the version of this that is painful to undo
- The snapshot policy lives here. A volume with no snapshot schedule is a single copy of your data on hardware that can fail, and creating the volume while leaving snapshots to "somebody else" is how an unbacked-up production disk happens, because somebody else is usually nobody
Smaller things the validation catches at plan rather than at apply:
multi_attachonly exists onio2target_tagson the snapshot policy must be non-empty, or it would match every volume in the accountinterval_hoursmust be one of the values DLM acceptsfinal_snapshotdefaults on, andforce_detachdefaults off - detaching a mounted volume corrupts the filesystem
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
aws-s3-bucket
Private S3 bucket with encryption, versioning, public-access block, and TLS-only policy.
aws-backup
A vault, its plans and what they protect, with the service role that can restore as well as back up. Vault Lock is stated rather than defaulted: COMPLIANCE mode cannot be removed by anybody once its window elapses, which is the point and is irreversible.
aws-efs
An EFS file system with mount targets, a least-privilege NFS security group, lifecycle tiering, automatic backups, and a resource policy that enforces encryption in transit.
aws-fsx-lustre
A Lustre file system with the S3 link, root squash and compression set deliberately. SCRATCH deployments are not replicated - a lost file server loses the data - so this defaults to PERSISTENT_2 and refuses the combinations FSx accepts quietly.