Amazon EBS now lets you copy a volume clone into a different AWS account and optionally re‑encrypt it with a KMS key that belongs to the target account. This removes the previous same‑AZ limitation and gives engineers a built‑in mechanism for moving production snapshots into isolated dev, test, or sandbox accounts.
How Cross‑Account Cloning Works
First, the volume owner creates a RAM share for the source volume. The share can be added to an existing resource share or a new one created in the AWS RAM console. The target account must accept the share in its RAM console before the volume appears in its EBS console. Once accepted, the target account can select Copy volume on the shared volume and start a clone operation.
Encryption and Key Management
Only volumes encrypted with a customer‑managed CMK or that are unencrypted can be shared. Volumes encrypted with the default AWS‑managed key cannot be shared. When a shared volume is encrypted with a CMK, that CMK must also be shared with the target account; otherwise the copy will fail. During the copy you can specify a different CMK in the target account, effectively re‑encrypting the clone with a key that matches the target account’s security policy.
Operational Steps and Automation
Manual steps are:
- In the source account, choose Share volume in the EBS console and add the target account to a RAM share.
- In the target account, accept the share in the RAM console.
- Locate the shared volume on the EBS volume page and choose Copy volume, selecting the desired KMS key if re‑encryption is required.
All of these actions are exposed through the EC2 API (e.g., ModifyVolumeAttribute for sharing and CopyVolume for the clone). The AWS MCP Server and its plugins can drive the same workflow programmatically, allowing integration with CI/CD pipelines or automated environment refresh scripts.
Monitoring and Auditing
The start of a cross‑account copy generates a SharedVolumeCopyInitiated event in CloudTrail. EventBridge can forward this event, and the volume state transitions to initializing. Monitoring these events lets you track when production data is being propagated to downstream accounts and can be tied to alerting or cost‑allocation dashboards.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
For AI, platform, DevOps, and security engineers, the new capability simplifies the data‑flow pattern that previously required manual snapshots, S3 export, or custom scripts. It also introduces clear boundaries: you must manage CMK sharing explicitly, and you cannot rely on default AWS‑managed keys for cross‑account clones. Evaluate your key‑rotation and sharing policies before enabling the feature, and instrument CloudTrail/EventBridge to ensure visibility of every copy operation. When integrated into automated environment refresh pipelines, the feature can reduce turnaround time for test data while preserving encryption hygiene across accounts.