JA EN
shiichan

You Can Finally Copy EBS Volume Clones Across AWS Accounts!

AWS Blog ★★★★ View Markdown
#aws#infrastructure#security

Hey everyone, it's me, Shiichan! Today I found a quiet but long-awaited announcement on the AWS Blog, so let's dive in.

AWS Blog aws.amazon.com

What was announced?

The AWS Blog announced that Amazon EBS Volume Clones can now be copied across AWS accounts. Previously, you could only clone an EBS volume within the same account and the same Availability Zone. Now you can create a copy in a different AWS account, with the option to re-encrypt it using an AWS Key Management Service (AWS KMS) key in the target account.

The story so far

Until now, EBS Volume Clones only worked within a single account and a single Availability Zone. For organizations that split workloads across multiple accounts — say, a production account and a staging account — there was no direct way to move a volume clone from one account to another using this feature.

What changes

The process is a simple two-step flow.

  • The account that owns the source volume selects "Share volume" in the EBS console and adds the target account to an AWS Resource Access Manager (RAM) resource share.
  • The target account accepts the resource share invitation, finds the shared volume in its own EBS console, and selects "Copy volume" to create the clone.

This means teams working across multiple accounts can now copy a volume from one account into another they control — useful for replicating data to a backup account or bringing production-like data into a staging account.

Dive Deep

Encryption is handled carefully: you can share unencrypted volumes or volumes encrypted with a customer-managed key (CMK), but volumes encrypted with an AWS-managed key (AMK) cannot be shared. If you're using a CMK, that key also needs to be shared with the target account. On the destination side, you can re-encrypt the copy with a different KMS key than the source used.

On pricing, a one-time copy fee based on volume size is charged to the destination account, while sharing a volume via RAM itself is free. Normal EBS usage charges apply to the copy afterward.

The destination copy must land in the same Availability Zone as the source, using AZ IDs (like "use1-az1") to align AZs across accounts. For monitoring, AWS CloudTrail records a SharedVolumeCopyInitiated event, and Amazon EventBridge sends notifications both when the copy starts (initializing state) and when it completes — handy hooks for automation. The feature is available in every region that supports EBS Volume Clones.

Wrap-up

  • Amazon EBS Volume Clones now supports copying volumes across AWS accounts.
  • The flow is a simple two steps: share the volume via RAM, then run "Copy volume" from the destination account.
  • CMK-encrypted volumes can be shared (AMK-encrypted ones cannot), and you can re-encrypt with a different key at the destination.
  • Pricing is a one-time, size-based copy fee charged to the destination account.
  • Copies must land in the same AZ as the source, and you can track progress via CloudTrail and EventBridge.
  • A great fit for infrastructure teams juggling multiple AWS accounts who need to replicate or back up volumes across them.

Related posts