Using encryption requires a manual step in the console

[vkurup]

If you choose to set to Enable Encryption by setting UseAES256Encryption: "true", you currently need to perform a manual step in the AWS EC2 console before you create your stack. In the EC2 console, look for the "EBS Encryption" link underneath the "Settings" section in the right panel.

This link might work to get you to that spot:
https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Settings:tab=ebsEncryption