A company wants to share a custom AMI, backed by EBS snapshots encrypted with a customer managed KMS key, with a second AWS account so that account can launch instances from it. What must they do?
- Sharing the AMI's launch permissions with the second account is sufficient by itself; encryption keys are automatically made available to any account granted launch permissions
- Encrypted AMIs can only ever be shared within the same AWS account; cross-account sharing of an encrypted AMI is not possible under any circumstances
- The company must switch the AMI's snapshots to use an AWS managed key before cross-account sharing becomes possible, since AWS managed keys support cross-account grants but customer managed keys do not
- The company must grant the second account launch permissions on the AMI AND update the customer managed KMS key's policy to grant that account the permissions needed to use the key (e.g., Decrypt, CreateGrant), since AWS managed keys cannot be shared across accounts at all
Why D? And why not the others?
Correct answer: D. The company must grant the second account launch permissions on the AMI AND update the customer managed KMS key's policy to grant that account the permissions needed to use the key (e.g., Decrypt, CreateGrant), since AWS managed keys cannot be shared across accounts at all
Sharing an AMI backed by encrypted snapshots across accounts requires two separate steps: granting the target account launch permissions on the AMI itself, and separately updating the key policy of the customer managed KMS key used to encrypt the underlying snapshots so the target account is granted the permissions it needs (such as Decrypt, CreateGrant, and DescribeKey) to actually use that key when launching instances from the shared AMI; a customer managed key is required for this because AWS managed keys are tied to a single account and can never be shared across accounts. The option claiming launch permissions alone are sufficient ignores that the destination account still has no way to decrypt the underlying snapshot data without explicit key access. The option claiming encrypted AMIs can never be shared across accounts is simply wrong; this is a well-documented, supported workflow, provided the key policy is configured correctly. The option suggesting a switch to an AWS managed key would enable cross-account sharing gets it backwards, since it's the AWS managed key that cannot be shared across accounts, while the customer managed key is exactly what makes controlled cross-account access possible.
Source: AWS Security Blog: How to share encrypted AMIs across accounts to launch encrypted EC2 instances; AWS KMS documentation on cross-account key policy grants