Automate cross-account snapshot copies with Data Lifecycle Manager

Open the AWS KMS console at https://console.aws.amazon.com/kms.

To change the AWS Region, use the Region selector in the upper-right corner of the page.

In the navigation pane, choose Customer managed key and then select the KMS key that you need to share with the target accounts.

Make note of the KMS key ARN, you'll need this later.

On the Key policy tab, scroll down to the Key users section. Choose Add, enter the name of the IAM role that you selected in the previous step, and then choose Add.

On the Key policy tab, scroll down to the Other AWS accounts section. Choose Add other AWS accounts, and then add all of the target AWS accounts that you chose to share the snapshots with in the previous step.

Choose Save changes.

Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

In the navigation pane, choose Elastic Block Store, Lifecycle Manager, and then choose Create lifecycle policy.

On the Select policy type screen, choose Cross-account copy event policy, and then choose Next.

For Policy description, enter a brief description for the policy.

For Policy tags, add the tags to apply to the lifecycle policy. You can use these tags to identify and categorize your policies.

In the Event settings section, define the snapshot sharing event that will cause the policy to run. Do the following:

1. For Sharing accounts, specify the source AWS accounts from which you want to copy the shared snapshots. Choose Add account, enter the 12-digit AWS account ID, and then choose Add.

2. For Filter by description, enter the required snapshot description using a regular expression. Only snapshots that are shared by the specified source accounts and that have descriptions that match the specified filter are copied by the policy. For more information, see Specify snapshot description filters.

For IAM role, choose the IAM role that has permissions to perform snapshot copy actions. To use the default role provided by Amazon Data Lifecycle Manager, choose Default role. Alternatively, to use a custom IAM role that you previously created, choose Choose another role and then select the role to use.

If you are copying encrypted snapshots, you must grant the selected IAM role permissions to use the encryption KMS key used to encrypt the source volume. Similarly, if you are encrypting the snapshot in the destination Region using a different KMS key, you must grant the IAM role permission to use the destination KMS key. For more information, see Step 4: Allow IAM role to use the required KMS keys (Target account).

In the Copy action section, define the snapshot copy actions that the policy should perform when it is activated. The policy can copy snapshots to up to three Regions. You must specify a separate copy rule for each destination Region. For each rule that you add, do the following:

1. For Name, enter a descriptive name for the copy action.

2. For Target Region, select the Region to which to copy the snapshots.

3. For Expire, specify how long to retain the snapshot copies in the target Region after creation.

4. To encrypt the snapshot copy, for Encryption, select Enable encryption. If the source snapshot is encrypted, or if encryption by default is enabled for your account, the snapshot copy is always encrypted, even if you do not enable encryption here. If the source snapshot is unencrypted and encryption by default is not enabled for your account, you can choose to enable or disable encryption. If you enable encryption, but do not specify a KMS key, the snapshots are encrypted using the default encryption KMS key in each destination Region. If you specify a KMS key for the destination Region, you must have access to the KMS key.

To add additional snapshot copy actions, choose Add new Regions.

For Policy status after creation, choose Enable policy to start the policy runs at the next scheduled time, or Disable policy to prevent the policy from running. If you do not enable the policy now, it will not start copying snapshots until you manually enable it after creation.

Choose Create policy.

Open the IAM console at https://console.aws.amazon.com/iam/.

In the navigation pane, select Roles. Search for and select the IAM role that you selected when you created the cross-account copy event policy in the previous step. If you chose to use the default role, the role is named AWSDataLifecycleManagerDefaultRole.

Choose Add inline policy and then select the JSON tab.

Replace the existing policy with the following, and specify the ARN of the KMS key that was used to encrypt the source volumes and that was shared with you by the source account in Step 2.

In the following example, the policy grants the IAM role permission to use KMS key 1234abcd-12ab-34cd-56ef-1234567890ab, which was shared by source account 111111111111, and KMS key 4567dcba-23ab-34cd-56ef-0987654321yz, which exists in target account 222222222222.

 {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kms:RevokeGrant",
                "kms:CreateGrant",
                "kms:ListGrants"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:111111111111:key/1234abcd-12ab-34cd-56ef-1234567890ab",
                "arn:aws:kms:us-east-1:222222222222:key/4567dcba-23ab-34cd-56ef-0987654321yz"		
            ],
            "Condition": {
                "Bool": {
                    "kms:GrantIsForAWSResource": "true"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "kms:Encrypt",
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:111111111111:key/1234abcd-12ab-34cd-56ef-1234567890ab",
                "arn:aws:kms:us-east-1:222222222222:key/4567dcba-23ab-34cd-56ef-0987654321yz"
            ]
        }
    ]
}

Choose Review policy

For Name, enter a descriptive name for the policy, and then choose Create policy.