Problem Description
EC2 restore failures with errors during snapshot creation. The failure is typically related to EBS encryption settings in the AWS environment.
Traceback
failed to provide Writer, failed to Start new Snapshot on snapshotId:snap-006a16bff34297203,
Error: operation error EBS: StartSnapshot, https response error StatusCode: 400, RequestID: fddf85b5-3b07-4e8c-9861-7fe8c095a8e0,
ValidationException: Encrypt cannot be false if EBS default encryption is enabled
Cause
The root cause is that AWS EBS default encryption is enabled at the account or region level.
The restore job attempted to create a snapshot or volume without encryption (Encrypt=false). AWS does not allow unencrypted volumes or snapshots when default encryption is enforced. This restriction is imposed by AWS, not Druva.
Resolution
Step 1: Confirm EBS Default Encryption Status
Navigate to AWS Console → EC2 → Elastic Block Store → Settings.
Check if EBS encryption by default is enabled. If enabled, all new volumes and snapshots must be encrypted.
Step 2: Update Restore Workflow / Tool Configuration
Ensure the restore process creates encrypted volumes/snapshots.
Avoid explicitly setting Encrypt=false.
For AWS CLI/SDK users:
Do not use --encrypted false or Encrypted: false.
Use --encrypted true or omit the parameter to allow AWS to enforce default encryption.
If using a backup/restore tool, verify its configuration to ensure encryption is enabled and not overridden.
Step 3: Retry the Restore
After updating the configuration, re-run the restore job.
The operation should now succeed as AWS enforces encryption.
Step 4: Additional Recommendations
Review backup/restore scripts and tools for any hardcoded encryption parameters.
Coordinate with your security team to understand why default encryption is enforced across the AWS environment.
References / See Also