rdearm1

You can turn on ebs encryption by default in the console for each region via API or SDK but not via CF. https://docs.amazonaws.cn/AWSEC2/latest/APIReference/API_EnableEbsEncryptionByDefault.html