Amazon EBS Encryption and Snapshot Sharing - Cross-Account and Cross-Region Design
A comprehensive guide covering default encryption setup, cross-account snapshot sharing, and cross-region copy for DR design.
EBS Default Encryption
Enabling EBS default encryption in the account's regional settings automatically encrypts all new EBS volumes and snapshots created in that region. Existing unencrypted volumes are not affected. You can choose between an AWS managed key (aws/ebs) or a customer managed key (CMK) for encryption. Using a CMK allows you to control access through key policies and enable automatic key rotation. The performance impact of encryption is negligible; on Nitro-based instances, hardware acceleration reduces the encryption overhead to near zero.
Cross-Account Snapshot Sharing
EBS snapshots can be shared with other AWS accounts. Unencrypted snapshots can be shared simply by specifying the account ID, but sharing encrypted snapshots requires additional configuration. You must grant the target account kms:DescribeKey, kms:CreateGrant, and kms:Decrypt permissions in the KMS key policy used for encryption. Snapshots encrypted with the AWS managed key (aws/ebs) cannot be shared, so if cross-account sharing is planned, encrypt with a CMK. When the target account creates a volume from the shared snapshot, it is recommended to re-encrypt with their own KMS key.
Cross-Region Copy and DR
Cross-region snapshot copy is a fundamental DR technique. Enabling cross-region copy in a DLM policy automatically copies snapshots to the DR region alongside daily snapshot creation. Retention generations can be configured independently for the destination region, allowing cost optimization such as retaining only the 3 most recent generations in the DR region. EBS Snapshots Archive moves infrequently accessed snapshots retained for 90 days or more to a low-cost archive tier, achieving up to 75% cost savings compared to standard storage. Restoring from the archive takes up to 72 hours, so snapshots requiring immediate recovery should remain in the standard tier. To broaden your knowledge of storage design, specialized books on Amazon can also be helpful.
EBS Snapshot Pricing
EBS snapshots use incremental backups, storing only changed blocks. Storage costs approximately $0.05 per GB/month. Cross-region copies incur storage costs in the destination region plus inter-region data transfer fees (approximately $0.02 per GB). Automate snapshot creation and deletion with DLM (Data Lifecycle Manager) and set appropriate retention periods to manage storage costs. EBS Snapshots Archive costs approximately $0.0125 per GB/month, reducing costs by 75% for snapshots retained 90 days or longer.
Summary
EBS encryption and snapshot management form the foundation of data protection and DR. Enforce encryption on all volumes with default encryption and control access with KMS keys. Build a multi-account, multi-region backup strategy through cross-account snapshot sharing and cross-region copy, and reduce long-term storage costs by up to 75% with EBS Snapshot Archive.