How can I share an encrypted Amazon RDS DB snapshot with another account?

Short description

You can't use the default AWS KMS encryption key to share a snapshot that's encrypted. For more information about the limitations of sharing DB snapshots, see Sharing encrypted snapshots.

To share an encrypted Amazon RDS DB snapshot, complete the following steps:

1. Add the target account to a custom (non-default) KMS key.
2. Use the customer managed key to copy the snapshot, and then share the snapshot with the target account.
3. Copy the shared DB snapshot from the target account.

Note: You can also follow the steps in the AWSSupport-ShareRDSSnapshot AWS Systems Manager Automation document to share your snapshot. Provide a snapshot to copy and share with the target account. You can also provide the DB instance or DB cluster ID to share with snapshots. Provide an existing KMS Key, or keep it blank to create a new key. For more information, see Add a key policy statement in the local account and Run an automation.

Resolution

Allow access to the target account on the AWS KMS key of the source account

1. Log in to the source account, and then open the AWS KMS console in the same AWS Region as the DB snapshot.
2. Choose Customer managed keys from the navigation pane.
3. Choose the name of your customer managed key. If you don't have a key, then choose Create key. For more information, see Creating keys.
4. From the Key administrators section, Add the AWS Identity and Access Management (IAM) users and roles who can administer the AWS KMS key.
5. From the Key users section, Add the IAM users and roles who can use the AWS KMS key (KMS key) to encrypt and decrypt data.
6. In the Other AWS accounts section, choose Add another AWS account, and then enter the AWS account number of the target account. For more information, see Allowing users in other accounts to use a KMS key.

Copy and share the snapshot

1. Open the Amazon RDS console, and then choose Snapshots from the navigation pane.
2. Choose the name of the snapshot that you created, choose Actions, and then choose Copy Snapshot.
3. Choose the same AWS Region that your KMS key is in, and then enter a New DB Snapshot Identifier.
4. In the Encryption section, choose the KMS key that you created.
5. Choose Copy Snapshot.
6. Share the copied snapshot with the target account.

Copy the shared DB snapshot

1. Log in to the target account, and then open the Amazon RDS console.
2. Choose Snapshots from the navigation pane.
3. From the Snapshots pane, choose the Shared with Me tab.
4. Select the DB snapshot that you shared.
5. Choose Actions. Then, choose Copy Snapshot to copy the snapshot into the same AWS Region and with a KMS key from the target account.

After you copy the DB snapshot, you can use the copy to launch the instance.

Related information

How can I change the encryption key used by my Amazon RDS DB instances and DB snapshots?

Encrypting Amazon RDS resources

Copying a DB snapshot