Question

A company's production account (Account A) encrypts EBS snapshots with a customer managed KMS key. The DR team in a separate account (Account B) needs to copy these shared snapshots and restore volumes from them in Account B. The security team has already shared the snapshots with Account B via the snapshot sharing feature. However, when Account B attempts to copy the snapshot, the operation fails with an access denied error. What must the security team configure to allow Account B to successfully copy and restore the encrypted snapshots while following least privilege?

Accepted Answer

Update the KMS key policy in Account A to grant Account B the permissions kms:DescribeKey, kms:CreateGrant, kms:Decrypt, and kms:ReEncrypt*, and ensure the IAM principal in Account B has matching KMS permissions in its identity policy.

Answer

Disable encryption on the source snapshots in Account A before sharing them, so Account B can copy plaintext snapshots without needing KMS access.

Answer

Enable automatic key rotation on the KMS key in Account A, which propagates the rotated key material to Account B and grants implicit cross-account decrypt access.

Answer

Add Account B as a principal in a resource policy on the EBS snapshot itself, granting ec2:CopySnapshot and ec2:CreateVolume permissions.