Encrypted Amazon RDS DB snapshots shared with another account can't be restored without first copying it locally in the shared account.

Question

Hey there, 
I'm looking for a way to share an encrypted RDS snapshot and restore it from the shared tab in the (shared account). 
More information:
Today we have encrypted snapshots in our main account, and we created a shared KMS to share the snapshots between accounts.
The process is working, and we can see the shared snapshot in the shared account, but the restored option is disabled. 
The snapshot is a big one over 3TB. Copying it locally **is not an option**.
Could someone please help me and tell me why AWS is not letting us restore the encrypted shared snapshot directly without copying it?

Gary Mclean · Accepted Answer

You have to copy the snapshot to the new account before you can restore it.

But yeah, snapshots need to encrypted with a kms key. Kms key needs to be accessible by the account where you are looking to restore the snapshot.

Sean · Answer

Just a heads up for anyone who is battling this issue.  AWS seems to be inconsistent on this.

**It used to work for me, then it stopped.**

I have been restoring shared snapshots directly to an RDS instance for weeks, without having to create an intermediary snapshot copy within the destination account.  However, yesterday this behavior changed suddenly.  Now I get the error message "Restoring db instance from cross account storage encrypted snapshot is not supported".  Cloudtrail logs show nothing has changed in my environment or the API call being invoked.

This error seems to be very rare; There are literally 2 results on google with this error message.  This makes me think that AWS often supports this behavior, but not always.  Perhaps restoring directly from cross-account shared snapshots was not purposefully designed, so they say it isn't supported even though it sometimes works.

**Two log entries that prove the inconsistent behavior of this functionality:**

Here is a snippet of a CloudTrail log entry showing a snapshot ARN from  being restored to  **working on 2024-26** :

```json
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "",
        "arn": "arn:aws:iam:::user/RedactedUserAccount",
        "accountId": "",
        "accessKeyId": "",
        "userName": "RedactedUserAccount"
    },
    "eventTime": "2024-06-26T00:33:03Z",
    "eventSource": "rds.amazonaws.com",
    "eventName": "RestoreDBInstanceFromDBSnapshot",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "",
    "userAgent": "",
    "requestParameters": {
        "dBSnapshotIdentifier": "arn:aws:rds:us-east-1::snapshot:",
        "engine": "mysql",
        "dBSubnetGroupName": "",
        "dBInstanceClass": "db.m6gd.xlarge",
        "dBInstanceIdentifier": "",
        "vpcSecurityGroupIds": [
            "sg-"
        ],
        "multiAZ": true
    }
...
```

And here is that exact same process (performed by automation) attempted the next day, when **it failed on 2024-06-27** :

```json
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "",
        "arn": "arn:aws:iam:::user/RedactedUserAccount",
        "accountId": "",
        "accessKeyId": "",
        "userName": "RedactedUserAccount"
    },
    "eventTime": "2024-06-27T03:08:12Z",
    "eventSource": "rds.amazonaws.com",
    "eventName": "RestoreDBInstanceFromDBSnapshot",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "",
    "userAgent": "",
    "errorCode": "InvalidParameterValueException",
    "errorMessage": "Restoring db instance from cross account storage encrypted snapshot is not supported.",
    "requestParameters": {
        "dBSnapshotIdentifier": "arn:aws:rds:us-east-1::snapshot:",
        "engine": "mysql",
        "dBSubnetGroupName": "",
        "dBInstanceClass": "db.m6gd.xlarge",
        "dBInstanceIdentifier": "",
        "vpcSecurityGroupIds": [
            "sg-"
        ],
        "multiAZ": true
    },
    "responseElements": null,
    "requestID": "",
    "eventID": "",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "",
    "eventCategory": "Management",
    "tlsDetails": {
        "tlsVersion": "TLSv1.3",
        "cipherSuite": "TLS_AES_128_GCM_SHA256",
        "clientProvidedHostHeader": "rds.us-east-1.amazonaws.com"
    }
}
```

**Currently, it *does* work for AWS support.**

As they work through my open case, an AWS support engineer reports that in his test environment he **is** able to restore RDS instances directly from cross-account shared snapshots, despite what this page says.  They are still researching to see why this function stopped working on my account, or why it does work for theirs.  Either way, it seems to be unreliable.

Denis Astahov - ADV-IT · Answer

Tested on Feb-2025:
* Encrypted Amazon RDS DB **Cluster** snapshots shared with another account **can be restored** without first copying it locally in the shared account.
* Encrypted Amazon RDS DB **Instance** snapshots shared with another account **can't be restored** without first copying it locally in the shared account anymore, previously it worked fine.

Encrypted Amazon RDS DB snapshots shared with another account can't be restored without first copying it locally in the shared account.

Relevant content