How To Copy an Encrypted RDS Using Default KMS Key to Another AWS Account
Published on October 01, 2022
By Hyuntaek Park
Senior full-stack engineer at Twigfarm
Usually, cloning a database is very easy through dump and restore. However, if you have your database in AWS RDS and if that RDS is encrypted with a default provided AWS KMS key, it is not that simple. AWS does not allow you to share the snapshot to a different account.
In order to overcome this problem, we need to make a few extra steps. In this article, I will demonstrate how to copy a snapshot; and finally, restore an RDS using the snapshot that is shared.
I created a simple Postgres database in my source account as the following:
As I mentioned earlier this RDS instance is encrypted using the default AWS KMS key.
Create a snapshot
Snapshots. Click the
Take snapshot button. Choose the DB Instance and name the snapshot as you like. Then click the
Take snapshot button
You need to wait a few minutes until the creation process is finished.
Share the snapshot (first try)
Once the snapshot creation is finished, choose the snapshot. Click the
Actions dropdown and click
This is where you specify the AWS destination account that the snapshot is to be shared.
Although I entered the correct AWS account number the
Save button is kept disabled.
And the error message is saying,
“Sharing snapshots encrypted with the default service key for RDS is currently not supported.”
We need a different way to share the snapshot.
Create a KMS key in the source account
Key Management Service (KMS) in the AWS console. Then click the
Create a key button.
Leave the options as they were unless you need to make a change.
Next button. Then enter
alias. Then click
Then choose your user name or a role if you want it that way. I chose my user name here. Click
Here, choose your user name again, then enter the destination account number. Then click
Check the key policy then click the
Finish button. Now that you have your first KMS key for the snapshot in the source account.
Copy the snapshot
Snapshots > choose the snapshot you created. Then click the
Actions dropdown then choose
Copy snapshot this time.
New DB Snapshot Identifier and ensure to choose the KMS key that you just created for the
AWS KMS key. Then click the
Copy snapshot button.
Wait a few minutes again while the snapshot copy is in progress.
Share the snapshot (second try)
When the copy of the snapshot is ready, choose the snapshot copy. Click the
Actions dropdown button then select the
Share snapshot button. Then add the destination AWS account ID. Basically, repeat the steps you did in Share the snapshot (first try) section.
This time, the save button is enabled. Click it!
Restore from the snapshot (first try)
Log in to the destination AWS account.
Shared with me. You should see a snapshot that we shared from the source account.
Our goal is to restore from this snapshot. Choose the snapshot. Click the
Actions dropdown button.
Restore snapshot button is disabled. We need to make another copy with a new destination KMS key.
Create a KMS key in the destination account
KMS then click
Create a key. Do the same as what we did in Create a KMS key in source account section except for
Copy the snapshot (Again but in the destination account)
Now we need to make a copy of the snapshot that is shared using the key that we have just created.
Shared with me. Choose the shared snapshot. Click
Be sure to Choose the newly made AWS KMS key.
Restore from the snapshot (second try)
Now choose the copied snapshot. Click
Actions dropdown button. Now you see the
Restore snapshot is enabled. Select
Fill in the database information. You will see your new database instance is created with the snapshot.
What a long way to copy(backup) and restore in a new AWS account. I hope AWS provides us with a better way to achieve this goal.