AWS Extends EBS Volume Clones to Cross-Account Copying, Adding KMS Re-Encryption and RAM-Based Sharing
AWS now lets customers clone Amazon EBS volumes into other AWS accounts, sharing them via AWS RAM and optionally re-encrypting with a KMS key in the target account.
Overview
Amazon Web Services has extended its Amazon EBS Volume Clones capability to support copying volumes across AWS accounts. According to the AWS News Blog, the update allows users to create point-in-time copies of EBS volumes in other AWS accounts, with optional re-encryption using an AWS Key Management Service (AWS KMS) key in the target account.
What We Know
The cross-account copy process happens in two steps, as described by the AWS News Blog: the volume owner first shares the volume with the target account through AWS Resource Access Manager (AWS RAM) by selecting “Share volume” in the EBS console, and the target account then accepts the resource share in RAM and selects “Copy volume” for the shared volume in its own EBS console. AWS’s What’s New announcement confirms the same mechanism, noting that after sharing, “the target account creates a copy of the shared volume in the same Availability Zone.”
On encryption, the AWS News Blog says unencrypted volumes and those encrypted with customer-managed keys (CMKs) can be shared, while volumes encrypted with AWS managed keys cannot. When a CMK-encrypted volume is copied, the CMK must also be shared with the target account, though users can specify a different CMK for re-encryption once the copy lands in the target account. The What’s New announcement frames two use cases for the feature: cloning a production database volume into an isolated development account so engineers get a fresh copy of production data to experiment with safely, and supporting teams that need encryption key separation across environments, such as keeping distinct KMS keys for production and non-production accounts.
For monitoring, the AWS News Blog reports that “SharedVolumeCopyInitiated” events are available through AWS CloudTrail, and Amazon EventBridge sends notifications when a copy operation starts and completes, including the shared volume ID and the consuming account ID.
On pricing, AWS charges a one-time fee to the target account based on volume size, while sharing a volume through RAM itself carries no cost; standard EBS volume charges apply to the copy once it is created, according to the AWS News Blog. The copied volume must land in the same Availability Zone as the source, and AWS recommends using Availability Zone IDs to match physical locations across accounts.
The capability is available wherever EBS Volume Clones is supported. The What’s New announcement specifies this includes “all Commercial Regions, the AWS GovCloud (US) Regions, AWS China Regions, and supported Local Zones,” and that the feature is accessible through the AWS Management Console, CLI, and SDKs.
What We Don’t Know
Neither announcement discloses the specific per-gigabyte rate for the one-time cross-account copy fee, nor does either source specify which AWS Regions currently support the underlying EBS Volume Clones feature that this update builds on.