AWS Introduces Cross-Account Copying for Amazon EBS Volume Clones

AWS has expanded the Amazon EBS Volume Clones feature, which was previously limited to the same Availability Zone, to allow copying volumes to different AWS accounts. This enables users to safely replicate production data into isolated test and development environments and re-encrypt it with the target account's AWS KMS key if needed.

How It Works and Security

Volume owners must grant access to the target account via AWS Resource Access Manager (RAM). Once the target account accepts the resource share, it can view the shared volume in its EBS console and perform the copy operation. For encrypted volumes, only those encrypted with a Customer Managed Key (CMK) can be shared; volumes encrypted with the default AWS Managed Key (AMK) cannot be shared. During copying, a different CMK from the target account can be specified for re-encryption.

Monitoring and Costs

Copy operations can be tracked via the SharedVolumeCopyInitiated event in AWS CloudTrail and Amazon EventBridge. Regarding costs, sharing itself is free, but a one-time fee based on volume size is charged to the target account when a copy is created, followed by standard EBS volume charges. Since copies must be created in the same Availability Zone as the original volume, Availability Zone IDs must be used to identify physical locations across accounts.