How do I share encrypted AMIs or snapshots across accounts to launch encrypted Amazon EC2 instances?

Short description

To automatically share encrypted AMIs or Amazon EBS snapshots across accounts and AWS Regions, use the AWSSupport-ShareEncryptedAMIOrEBSSnapshot runbook.

Or, manually modify your configuration to share the encrypted AMIs and snapshots.

Important: The AWSSupport-ShareEncryptedAMIOrEBSSnapshot runbook modifies your resources to configure cross-account access. You might incur costs for copies of resources across Regions. If you use an AWS managed key, then the runbook automatically creates a customer managed key. The runbook uses the key to copy and share the AMI or snapshot. You can't use an AWS managed key to manually share encrypted AMIs or snapshots.

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Use the AWSSupport-ShareEncryptedAMIOrEBSSnapshot to automatically share encrypted AMIs or Amazon EBS snapshots

Prerequisites: Make sure that you adhere to the following configuration requirements:

• You have the correct destination account ID.
• Your AWS Identity and Access Management (IAM) user or role has the required permissions. For more information, see Required IAM permissions on AWSSupport-ShareEncryptedAMIOrEBSSnapshot.
• Your destination account allows its users or roles to launch encrypted instances with the AWS Key Management Service (AWS KMS) key from the source account. For an example IAM policy, see Required AWS AWS Identity and Access Management policy for destination account on AWSSupport-ShareEncryptedAMIOrEBSSnapshot.
  Note: The runbook automatically modifies the AWS KMS key policy in the source account to grant cross-account access to the destination account. You must configure only the IAM user or role permissions in the destination account.
• The AMI is in the Available state or the Amazon EBS snapshot is in the Completed state.
• To copy across Regions, the customer managed AWS KMS key must exist and be set to Enabled in the destination Region. To check the key status, run the following describe-key AWS CLI command:

  aws kms describe-key --key-id key-example-id --region destination-region

  Note: Replace key-example-id with your AWS KMS key ID and destination-region with the Region of your destination account.
• The customer managed AWS KMS key must not be an AWS managed key.

To run the runbook, see Instructions on AWSSupport-ShareEncryptedAMIOrEBSSnapshot. Make sure to run the runbook in the source account that has the AMI or snapshot.

Note: The runbook automatically rolls back changes if it fails. However, if the rollback fails, then manually check your account to verify that there aren't additional AMI or snapshot copies. Also, make sure that the LaunchPermission and CreateVolumePermission only list the required accounts, and that the AWS KMS key policy is in its original state.

Manually share encrypted AMIs

Prerequisite: Make sure that you adhere to the requirements to share AMIs.

To manually share encrypted AMIs across accounts, complete the following steps:

1. Review the AMI encryption details.
   Note: You can't share AWS managed keys across accounts. As a result, you can't share AMIs that you encrypted with the default AWS managed key. If you used an AWS managed key to encrypt the AMI, then copy the AMI and use a customer managed key to encrypt the new AMI.
2. Share the AMI with the destination account.
   Note: The destination account is the account that launches the encrypted EC2 instances with the shared custom AMIs.
3. Edit the key policy to allow users in the destination account to access the AWS KMS key.
4. Create an IAM user or role in the destination account. Then, attach a policy to the role that gives it DescribeKey, ReEncrypt*, Decrypt, GenerateDataKeyWithoutPlainText, and CreateGrant permissions for your AWS KMS key.
   Example policy:

   {  "Version": "2012-10-17",  "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "kms:DescribeKey",
           "kms:ReEncrypt*",
           "kms:Decrypt",
           "kms:GenerateDataKeyWithoutPlainText",
           "kms:CreateGrant"
         ],
         "Resource": [
           "arn:aws:kms:us-east-1:111111111111:key/cmkSource"
         ]
       }
     ]
   }

   Note: Replace 111111111111 with the source account ID with the encrypted AMI, us-east-1 with your Region, and cmkSource with the ID of the customer managed key.
5. To launch an instance from the shared AMI, open the Amazon EC2 console in the destination account.
6. In the navigation pane, choose EC2 dashboard, and then choose Launch instance.
7. Under Names and tags, for Name, enter a name for your EC2 instance.
8. Under Application and OS Images (Amazon Machine Image), choose Browse more AMIs to find the shared encrypted AMI.
9. Choose My AMIs, and then choose Shared with me.
10. Under Instance type, select an instance type.
11. Under Key pair (login), for Key pair name, select a key pair. Or, create a new one.
12. (Optional) Under Network settings, choose Edit, and then select your virtual private cloud (VPC) or subnets.
13. Under Configure storage, choose Advanced.
14. Under EBS Volumes, expand Volume.
15. Under Encrypted, choose Encrypted.
16. Under KMS key, choose Specify a custom value, and then enter the full Amazon Resource Name (ARN) of your key, such as arn:aws:kms:us-east-1:111111111111:key/key-id.
    Note: If you don't choose an AWS KMS key, then Amazon EC2 uses the destination account's default key for Amazon EBS encryption.
17. Under Summary, choose Launch instance.

Manually share encrypted snapshots

Prerequisite: Make sure that you adhere to the requirements to share snapshots.

To manually share encrypted snapshots across accounts, complete the following steps:

1. Review the snapshot encryption details.
   Note: You can't share AWS managed keys across accounts. As a result, you can't share snapshots that you encrypted with the default AWS managed key. If you used an AWS managed key to encrypt the snapshot, then copy the snapshot and use a customer managed key to encrypt the new snapshot.
2. Share the snapshot with the destination account.
   Note: The destination account is the account that creates volumes from the shared encrypted snapshot.
3. Edit the key policy to allow users in the destination account to access the AWS KMS key.
4. Create an IAM user or role in the destination account. Then, attach a policy to the role that gives it DescribeKey, ReEncrypt*, Decrypt, GenerateDataKeyWithoutPlainText, and CreateGrant permissions for your AWS KMS key.
   Example policy:

   {  "Version": "2012-10-17",  "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "kms:DescribeKey",
           "kms:ReEncrypt*",
           "kms:Decrypt",
           "kms:GenerateDataKeyWithoutPlainText",
           "kms:CreateGrant"
         ],
         "Resource": [
           "arn:aws:kms:us-east-1:111111111111:key/cmkSource"
         ]
       }
     ]
   }

   Note: Replace 111111111111 with the source account ID with the encrypted AMI, us-east-1 with your Region, and cmkSource with the ID of the customer managed key.
5. Create a volume from the shared snapshot in the destination account.

Related information

How do I share an Amazon Machine Image (AMI) privately with another AWS account?

Instance-launching scenarios

Launch an Amazon EC2 instance

How do I launch an EC2 instance from a custom AMI?

How to share encrypted AMIs across accounts to launch encrypted EC2 instances