How To Copy an Encrypted RDS Using Default KMS Key to Another AWS Account

Published on October 01, 2022

By Hyuntaek Park

Senior full-stack engineer at Twigfarm

Usually, cloning a database is very easy through dump and restore. However, if you have your database in AWS RDS and if that RDS is encrypted with a default provided AWS KMS key, it is not that simple. AWS does not allow you to share the snapshot to a different account.

In order to overcome this problem, we need to make a few extra steps. In this article, I will demonstrate how to copy a snapshot; and finally, restore an RDS using the snapshot that is shared.

Source Database

I created a simple Postgres database in my source account as the following:

As I mentioned earlier this RDS instance is encrypted using the default AWS KMS key.

Create a snapshot

Go to RDS > Snapshots. Click the Take snapshot button. Choose the DB Instance and name the snapshot as you like. Then click the Take snapshot button

You need to wait a few minutes until the creation process is finished.

Once the snapshot creation is finished, choose the snapshot. Click the Actions dropdown and click Share snapshot.

This is where you specify the AWS destination account that the snapshot is to be shared.

Although I entered the correct AWS account number the Save button is kept disabled.

And the error message is saying,

“Sharing snapshots encrypted with the default service key for RDS is currently not supported.”

We need a different way to share the snapshot.

Create a KMS key in the source account

Go to Key Management Service (KMS) in the AWS console. Then click the Create a key button.

Leave the options as they were unless you need to make a change.

Click the Next button. Then enter alias. Then click Next again.

Then choose your user name or a role if you want it that way. I chose my user name here. Click Next.

Here, choose your user name again, then enter the destination account number. Then click Next.

Check the key policy then click the Finish button. Now that you have your first KMS key for the snapshot in the source account.

Copy the snapshot

Go to RDS > Snapshots > choose the snapshot you created. Then click the Actions dropdown then choose Copy snapshot this time.

Enter New DB Snapshot Identifier and ensure to choose the KMS key that you just created for the AWS KMS key. Then click the Copy snapshot button.

Wait a few minutes again while the snapshot copy is in progress.

When the copy of the snapshot is ready, choose the snapshot copy. Click the Actions dropdown button then select the Share snapshot button. Then add the destination AWS account ID. Basically, repeat the steps you did in Share the snapshot (first try) section.

This time, the save button is enabled. Click it!

Restore from the snapshot (first try)

Log in to the destination AWS account. Go to RDS > Snapshots > Shared with me. You should see a snapshot that we shared from the source account.

Our goal is to restore from this snapshot. Choose the snapshot. Click the Actions dropdown button.

Unfortunately Restore snapshot button is disabled. We need to make another copy with a new destination KMS key.

Create a KMS key in the destination account

Go to KMS then click Create a key. Do the same as what we did in Create a KMS key in source account section except for Alias.

Copy the snapshot (Again but in the destination account)

Now we need to make a copy of the snapshot that is shared using the key that we have just created.

Go to RDS > Snapshots > Shared with me. Choose the shared snapshot. Click Actions > Copy snapshot

Be sure to Choose the newly made AWS KMS key.

Restore from the snapshot (second try)

Now choose the copied snapshot. Click Actions dropdown button. Now you see the Restore snapshot is enabled. Select Restore snapshot.

Fill in the database information. You will see your new database instance is created with the snapshot.

What a long way to copy(backup) and restore in a new AWS account. I hope AWS provides us with a better way to achieve this goal.

Thanks!