diff --git a/test/machines/machines_test.go b/test/machines/machines_test.go
index 024cee48a0..1175438f2a 100644
--- a/test/machines/machines_test.go
+++ b/test/machines/machines_test.go
@@ -202,7 +202,38 @@ var _ = framework.SigKubeDescribe("Machines", func() {
 		})
 
 		It("Can create EBS volumes", func() {
-			testMachineProviderSpec, err := utils.TestingMachineProviderSpecWithEBS(awsCredSecret.Name, cluster.Name)
+			testMachineProviderSpec, err := utils.TestingMachineProviderSpecWithEBS(awsCredSecret.Name, cluster.Name, false)
+			Expect(err).NotTo(HaveOccurred())
+			testMachine := manifests.TestingMachine(cluster.Name, cluster.Namespace, testMachineProviderSpec)
+			f.CreateMachineAndWait(testMachine, acw)
+			machinesToDelete.AddMachine(testMachine, f, acw)
+
+			volumes, err := acw.GetVolumes(testMachine)
+			Expect(err).NotTo(HaveOccurred())
+
+			By("Checking EBS volume mount", func() {
+				Expect(volumes).To(HaveKey("/dev/sda1"))
+			})
+
+			By("Checking EBS volume size", func() {
+				Expect(volumes["/dev/sda1"]["size"].(int64)).To(Equal(int64(142)))
+			})
+
+			By("Checking EBS volume type", func() {
+				Expect(volumes["/dev/sda1"]["type"].(string)).To(Equal("gp2"))
+			})
+
+			By("Checking only root volume get's modified", func() {
+				for dev, volume := range volumes {
+					if dev != "/dev/sda1" {
+						Expect(volume["size"].(int64)).ToNot(Equal(int64(142)))
+					}
+				}
+			})
+		})
+
+		It("Can create encrypted EBS volumes", func() {
+			testMachineProviderSpec, err := utils.TestingMachineProviderSpecWithEBS(awsCredSecret.Name, cluster.Name, true)
 			Expect(err).NotTo(HaveOccurred())
 			testMachine := manifests.TestingMachine(cluster.Name, cluster.Namespace, testMachineProviderSpec)
 			f.CreateMachineAndWait(testMachine, acw)
diff --git a/test/utils/manifests.go b/test/utils/manifests.go
index fef47d75f2..52e5c5b9d1 100644
--- a/test/utils/manifests.go
+++ b/test/utils/manifests.go
@@ -101,13 +101,14 @@ func TestingMachineProviderSpec(awsCredentialsSecretName string, clusterID strin
 	return *config, nil
 }
 
-func TestingMachineProviderSpecWithEBS(awsCredentialsSecretName string, clusterID string) (machinev1beta1.ProviderSpec, error) {
+func TestingMachineProviderSpecWithEBS(awsCredentialsSecretName string, clusterID string, encrypted bool) (machinev1beta1.ProviderSpec, error) {
 	volumeSize := int64(142)
 	volumeType := "gp2"
 	machinePc := testingAWSMachineProviderSpec(awsCredentialsSecretName, clusterID)
 	machinePc.BlockDevices = []providerconfigv1.BlockDeviceMappingSpec{
 		{
 			EBS: &providerconfigv1.EBSBlockDeviceSpec{
+				Encrypted:  &encrypted,
 				VolumeSize: &volumeSize,
 				VolumeType: &volumeType,
 			},