How do I share encrypted AMIs across accounts to launch encrypted EC2 instances?

Resolution

Prerequisite: Make sure that you adhere to the requirements to share AMIs.

To share encrypted AMIs across accounts, complete the following steps:

1. Review the AMI encryption details.
   Note: You can't share AWS managed keys across accounts. As a result, you can't share AMIs that you encrypted with the default AWS managed key. If you used an AWS managed key to encrypt the AMI, then copy the AMI and use a customer managed key to encrypt the new AMI.
2. Share the AMI with the target account.
   Note: The target account is your account that launches the encrypted EC2 instances with shared custom AMIs.
3. Edit the key policy to allow users in the target account to access the AWS Key Management Service (AWS KMS) key.
4. Create an AWS Identity and Access Management (IAM) user or role in the target account. Then, attach a policy to the role that gives it DescribeKey, ReEncrypt*, Decrypt, GenerateDataKeyWithoutPlainText, and CreateGrant permissions for your AWS KMS key. Example policy:

   {  "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "kms:DescribeKey",
           "kms:ReEncrypt*",
           "kms:Decrypt",
           "kms:GenerateDataKeyWithoutPlainText",
           "kms:CreateGrant"
         ],
         "Resource": [
           "arn:aws:kms:us-east-1:111111111111:key/cmkSource"
         ]
       }
     ]
   }

   Note: Replace 111111111111 with the source account ID with the encrpyted AMI, us-east-1 with your AWS Region, and cmkSource with the ID of the customer managed key.
5. Open the Amazon EC2 console.
6. In the navigation pane, choose EC2 dashboard, and then choose Launch instance.
7. Under Names and tags, for Name, enter a name for your instance.
8. Under Application and OS Images (Amazon Machine Image), choose Browse more AMIs to find the shared encrypted AMI.
9. Choose My AMIs, and then choose Shared with me.
10. Under Instance type, select an instance type.
11. Under Key pair (login), for Key pair name, select a key pair. Or, create a new one.
12. (Optional) Under Network settings, choose Edit, and then select your virtual private cloud (VPC) or subnets.
13. Under Configure storage, choose Advanced.
14. Under EBS Volumes, expand Volume.
15. Under Encrypted, choose Encrypted.
16. Under KMS key, choose Specify a custom value, and then enter the full Amazon Resource Name (ARN) of your key. For example, arn:aws:kms:us-east-1:111111111111:key/key-id.
    Note: If you don't choose an AWS KMS key, then Amazon EC2 uses the target account's default key for Amazon Elastic Block Store (Amazon EBS) encryption.
17. Under Summary, choose Launch instance.

For more information, see Launch an EC2 instance using the launch instance wizard in the console.

Related information

How do I share an Amazon Machine Image (AMI) privately with another AWS account?

Instance-launching scenarios

Launch an Amazon EC2 instance

How do I launch an EC2 instance from a custom AMI?