Step 1: Create one shared KMS key
First, we need to create one KMS key.
- In the Key Management Console, choose Customer managed keys
- Choose the create key.
3. Choose key type Symmetric and key usage Encrypt and decrypt.
4. Then, expand Advanced options. Choose Key material origin as KMS and Regionality as Multi-Region key. Click on Next.
5. Give alias name
6. Click on Next.
7. Choose any Key administrators and select Next.
8. Select any Key users and click on Add another AWS account. Give Target AWS account ID.
9. Select Next. Then, Review and Finish.
Step 2: Create one snapshot from the encrypted EBS volume using the AWS managed key(aws/ebs)
- Go to the EC2 console. Then, on the left side pane, select Volumes. Select the check box of exact volume. Click on Actions and select Create Snapshot.
- Give an appropriate description and select Create Snapshot.
Snapshot:
Step 3: Create another snapshot from the previous snapshot using the Share KMS key
- Now, we need to create another snapshot from the previous snapshot.
- on the left side pane, select Snapshots.
- Choose the exact Snapshot. Click on Actions and select Copy Snapshot.
4. Give an appropriate description and choose the share KMS key. Select Copy Snapshot.
Step 4: Create one AMI using a snapshot, which one created using the share KMS key
Now, we will create one AMI using this snapshot, which is created using the shared KMS key.
- In the Snapshots section, choose the exact snapshot and select Actions. Choose to Create image from snapshot.
2. Give an Image name. Select Create image.
Step 5: Migrate encrypted AMI
- In the EC2 console, on the life side pane, go to the AMIs section.
- Choose the exact AMI. Click on Actions and select Edit AMI permissions.
3. Click on the checkbox (Add ‘Create volume’ permission to associated snapshots when creating account permissions.)
4. In the Shared accounts section, Click on Add account ID. Give the account ID of the destination/target account. Click on Save Changes.
Now, go to the destination/target account and in the EC2 console, go to the AMIs section, we can see the shared AMI. Using this shared AMI, we can launch EC2 Instance in the destination account.
