Amazon Web Services adds cross-account EBS volume copies

Amazon Web Services has added cross-account copy for Amazon Elastic Block Store volume clones. The feature is available in all AWS Regions that already support EBS Volume Clones.

Customers can now create copies of EBS volumes in another AWS account and re-encrypt those copies with a key held in the target account. The addition is intended for customers that want to refresh development and test environments with recent production data while keeping those environments in separate accounts.

EBS Volume Clones were introduced earlier as a way to create instant point-in-time copies of EBS volumes within the same Availability Zone. The latest update extends that model across accounts, though the copy must still be created in the same Availability Zone as the source volume.

Under the AWS process, the volume owner first shares it with another account through AWS Resource Access Manager. The target account must accept the resource share before the volume becomes visible for copying in the EBS console.

Once accepted, users in the target account can select a shared volume and create a copy from their own account. They can also re-encrypt the copied volume with an AWS Key Management Service key in that account.

Encryption rules

The new option limits which volumes can be shared. Unencrypted volumes can be shared, as can volumes encrypted with a customer-managed key.

Volumes encrypted with the default AWS managed key cannot be shared across accounts. If a source volume is encrypted with a customer-managed key, that key must also be shared with the target account before a copy can be created.

Customers can specify a different customer-managed key when creating the copied volume in the destination account. This lets the target environment keep data under its own encryption settings rather than inherit the original key unchanged.

Monitoring and cost

Customers can track copy activity through the SharedVolumeCopyInitiated event in AWS CloudTrail. They can also use Amazon EventBridge notifications at the start of the copy process, when the copied volume enters an initialising state, and at the end, when its state changes to completed.

These events include details such as the shared volume ID, the consuming account ID, and the event time. That gives administrators an audit trail for copies that move storage assets from one AWS account boundary to another.

Charges apply to the account where the copied volume will reside. Customers pay a one-time fee based on the volume size when the copy starts, and the copied volume then incurs standard ongoing EBS storage charges after creation.

There is no charge for sharing EBS volumes through AWS Resource Access Manager itself. That means the destination account bears the direct cost of creating and storing the new volume copy.

Operational use

The feature is likely to be most relevant for organisations that separate production, testing, and development workloads into different AWS accounts for governance or security reasons. In those setups, teams often need current application data outside the production account without moving entire environments.

AWS advises users to identify the same physical location across accounts with Availability Zone IDs such as use1-az1. That is necessary because account-specific zone names can differ even when they refer to the same underlying AWS infrastructure.

AWS also pointed to programmatic support for sharing and copying EBS volumes across accounts through APIs. That provides an automation path for customers that manage infrastructure changes through scripts or internal tooling rather than the console alone.

The update adds another way to move storage data across account boundaries inside AWS without relying only on snapshot-based workflows. It also gives customers a way to copy recent block storage content into isolated accounts while preserving control over encryption and audit records.