diff --git a/terraform/layer1-aws/aws-ebs.tf b/terraform/layer1-aws/aws-ebs.tf
new file mode 100644
index 00000000..1a20ec8f
--- /dev/null
+++ b/terraform/layer1-aws/aws-ebs.tf
@@ -0,0 +1,3 @@
+resource "aws_ebs_encryption_by_default" "this" {
+  enabled = true
+}