Question

During an active incident, a security engineer must preserve an EBS volume from a compromised EC2 instance for later forensic analysis in a dedicated forensics account. The forensics account uses a customer-managed KMS key to encrypt all evidence. The source volume is encrypted with a different customer-managed KMS key in the production account. The engineer creates a snapshot of the volume and attempts to share it directly with the forensics account, but the account cannot access it. What is the correct sequence to make the encrypted evidence usable in the forensics account while maintaining chain of custody?

Accepted Answer

Grant the forensics account decrypt permissions on the production KMS key, share the encrypted snapshot, then copy it in the forensics account re-encrypting with the forensics KMS key.

Answer

Decrypt the snapshot in the production account, remove encryption, share the unencrypted snapshot, then re-encrypt it after copying into the forensics account.

Answer

Copy the snapshot with the AWS-managed aws/ebs key first, then share it, since AWS-managed keys are automatically shareable across accounts.

Answer

Enable default EBS encryption in the forensics account and share the snapshot; EC2 will automatically re-encrypt it on import with the forensics key.