Question

A company runs an encrypted Amazon RDS MySQL database in a production account. The database uses a customer managed AWS KMS key. The security team must share an encrypted automated snapshot with a separate auditing account so that auditors can restore a copy of the database for review. When the security engineer attempts to share the snapshot, the auditing account cannot restore it. What must the engineer do to allow the auditing account to successfully restore the shared encrypted snapshot?

Accepted Answer

Copy the automated snapshot to a manual snapshot re-encrypted with a customer managed KMS key, share both the manual snapshot and grant the auditing account kms:Decrypt/CreateGrant permissions on that key via the key policy.

Answer

Enable automatic key rotation on the KMS key so the auditing account can derive the key material, then share the automated snapshot directly.

Answer

Share the automated snapshot directly and add the auditing account as a trusted principal in the RDS resource policy so it can decrypt the snapshot.

Answer

Re-encrypt the snapshot using the AWS managed aws/rds key and share that snapshot, because AWS managed keys are automatically shareable across accounts.