How do I share an encrypted Amazon Aurora snapshot with another account?

Short description

You can't share a snapshot that's encrypted with the default AWS KMS key. Instead, you must create a custom AWS KMS key. To share an encrypted Aurora DB cluster snapshot, complete the following steps:

1. Create a custom AWS KMS key, and then add the target account.
2. Use the AWS KMS key to create a copy of the DB cluster snapshot, and then share the new snapshot copy with the target account.
3. Copy the shared DB cluster snapshot from the target account.

Resolution

Create a custom AWS KMS key

Log in to the source account. Then, create a symmetric encryption key and select Add another AWS account for Other AWS accounts. Enter the target account number. For more information about cross-account permissions, see Allowing users in other accounts to use an AWS KMS key.

Copy and share the DB cluster snapshot

Copy the DB cluster snapshot and configure the following settings:

• For Destination Region, select the AWS Region that your custom AWS KMS key is in.
• Under Encryption, for AWS KMS Key, select the custom AWS KMS key that you created.

Then, share the snapshot with the other account.

Copy the shared DB cluster snapshot

Complete the following steps:

1. Log in to the target account.
2. Open the Amazon Relational Database Service (Amazon RDS) console.
3. In the navigation pane, choose Snapshots.
4. Under Snapshots, choose the Shared with me tab.
5. Select the DB cluster snapshot that you shared.
6. Choose Actions, and then choose Copy snapshot to copy the DB cluster snapshot into the same Region.

The AWS KMS key can be the default key or a customer-managed key. You can use the snapshot to launch the instance.

Related information

Sharing a DB cluster snapshot

Create an asymmetric KMS key

Multi-Region keys in AWS KMS

DB cluster snapshot copying