diff --git a/etcd.tf b/etcd.tf
index e4c1988..f5f5bb4 100644
--- a/etcd.tf
+++ b/etcd.tf
@@ -19,9 +19,11 @@ module "etcd_node_01" {
   assets_bucket_name = "${var.assets_bucket_name}"
   availability_zone = "${element(var.subnets["availability_zones"], 0)}"
   cluster_name = "${var.cluster["name"]}"
+  ebs_encrypted = "${var.ebs_encrypted}"
   instance_profile = "${module.iam.etcd_instance_profile}"
   internal_domain_name = "${var.domain_names["internal"]}"
   internal_domain_zone_id = "${module.common_dns.domain_zone_ids["internal"]}"
+  kms_key_id = "${var.kms_key_id}"
   private_subnet_id = "${element(module.vpc.private_subnet_ids, 0)}"
   region = "${var.aws_region}"
   security_groups = [
@@ -37,9 +39,11 @@ module "etcd_node_02" {
   assets_bucket_name = "${var.assets_bucket_name}"
   availability_zone = "${element(var.subnets["availability_zones"], 0)}"
   cluster_name = "${var.cluster["name"]}"
+  ebs_encrypted = "${var.ebs_encrypted}"
   instance_profile = "${module.iam.etcd_instance_profile}"
   internal_domain_name = "${var.domain_names["internal"]}"
   internal_domain_zone_id = "${module.common_dns.domain_zone_ids["internal"]}"
+  kms_key_id = "${var.kms_key_id}"
   private_subnet_id = "${element(module.vpc.private_subnet_ids, 0)}"
   region = "${var.aws_region}"
   security_groups = [
@@ -55,9 +59,11 @@ module "etcd_node_03" {
   assets_bucket_name = "${var.assets_bucket_name}"
   availability_zone = "${element(var.subnets["availability_zones"], 0)}"
   cluster_name = "${var.cluster["name"]}"
+  ebs_encrypted = "${var.ebs_encrypted}"
   instance_profile = "${module.iam.etcd_instance_profile}"
   internal_domain_name = "${var.domain_names["internal"]}"
   internal_domain_zone_id = "${module.common_dns.domain_zone_ids["internal"]}"
+  kms_key_id = "${var.kms_key_id}"
   private_subnet_id = "${element(module.vpc.private_subnet_ids, 0)}"
   region = "${var.aws_region}"
   security_groups = [
diff --git a/io.tf b/io.tf
index 27c292b..545d1aa 100644
--- a/io.tf
+++ b/io.tf
@@ -24,12 +24,14 @@ variable "cluster" {
   }
 }
 variable "domain_names" { default = { internal = "kubit.local" } }
+variable "ebs_encrypted" { default = true }
 variable "hyperkube" {
   default = {
     repository = "quay.io/coreos/hyperkube"
     version = "v1.5.2_coreos.1"
   }
 }
+variable "kms_key_id" { default = "" }
 variable "subnets" {
   default = {
     availability_zones = ["a","b","c"]
diff --git a/modules/etcd_node/etcd_node.tf b/modules/etcd_node/etcd_node.tf
index c6d2a91..9698dcf 100644
--- a/modules/etcd_node/etcd_node.tf
+++ b/modules/etcd_node/etcd_node.tf
@@ -57,6 +57,8 @@ resource "aws_ebs_volume" "etcd" {
   availability_zone = "${format("%s%s", var.region, var.availability_zone)}"
   size = 4
   type = "gp2"
+  encrypted = "${var.ebs_encrypted}"
+  kms_key_id = "${var.kms_key_id}"
   tags { Name = "${var.cluster_name}-etcd-${var.unique_id}" }
 }
 
diff --git a/modules/etcd_node/io.tf b/modules/etcd_node/io.tf
index 2357502..8b6fdeb 100644
--- a/modules/etcd_node/io.tf
+++ b/modules/etcd_node/io.tf
@@ -18,10 +18,12 @@ variable "assets_bucket_name" {}
 variable "availability_zone" {}
 variable "cluster_name" {}
 variable "coreos_channel" { default = "stable" }
+variable "ebs_encrypted" {}
 variable "instance_profile" {}
 variable "instance_type" { default = "m4.large" }
 variable "internal_domain_name" {}
 variable "internal_domain_zone_id" {}
+variable "kms_key_id" {}
 variable "private_subnet_id" {}
 variable "region" {}
 variable "security_groups" { type = "list" }