EBS Volume Clones Now Support Cross-Account Copies

EBS volume clones can now be copied to other AWS accounts.

What changed

• EBS volume clones can be copied to a different AWS account.
• Option to re-encrypt the cloned volume using a KMS key in the target account.
• This functionality is available in all AWS Regions.

Why it matters

This feature directly addresses the complexity of sharing or backing up EBS volumes across account boundaries. Previously, this required more involved processes, potentially involving snapshots and manual transfers. The honest version: This is a significant quality-of-life improvement for organizations managing multiple AWS accounts, enabling easier disaster recovery strategies and data seeding for development or testing environments without resorting to custom tooling or snapshot workarounds. It simplifies the operational overhead for cross-account data mobility.

The catch

Watch out: While the announcement states availability in all regions, the actual implementation details for KMS key policies and IAM permissions required for cross-account access can be intricate. The process of setting up these permissions correctly is not detailed in the announcement, and misconfiguration can lead to failed copies. Pairs with: AWS Key Management Service (KMS) and IAM for managing access controls.

Ship it

If you are currently using EBS snapshots to share or back up volumes across accounts, migrate to EBS Volume Clones for a more streamlined workflow. Ensure your IAM roles and KMS key policies in both the source and target accounts are configured to permit the necessary ec2:CopySnapshot and kms:Encrypt/kms:Decrypt actions as appropriate.

Bottom line: EBS volume clones can now be copied across AWS accounts, simplifying cross-account data sharing and DR.

— Filed to /blog