Amazon EBS Volume Clones Now Cross Account Boundaries — Without Snapshots

Getting production data into a test account — without creating intermediate snapshots, copying through S3, or sharing snapshot access across account boundaries — has required custom tooling since multi-account AWS architectures became standard. EBS Volume Clones now do it directly.

What Happened

AWS extended EBS Volume Clones to cross account boundaries. The mechanism uses Resource Access Manager: the source account grants volume access through a RAM share, the target account accepts the resource share invitation, and the target account creates an instant point-in-time copy. Three API calls and the clone exists in the target account — owned entirely by the target account, with no ongoing relationship to the source.

Optional re-encryption with a different customer-managed KMS key happens at copy time. This is the critical feature for teams whose production volumes are encrypted with a production KMS key that shouldn’t exist in the dev account.

Why It Matters

The previous workflow for refreshing test environments with production data involved creating a snapshot in the source account, sharing the snapshot, importing it in the target account, and creating a volume from it. Four to six steps, snapshot storage costs at both ends, and a timing gap between snapshot creation and volume availability.

Volume Clones skip the snapshot tier entirely. The copy runs account-to-account, the target account owns the resulting volume, and the operation is instant at the point-in-time of the copy rather than dependent on snapshot replication completing. For teams that refresh test and staging environments regularly with production data — the pattern AWS Well-Architected explicitly recommends for pre-migration validation — this cuts a recurring workflow to three calls.

What This Means for Builders

Test refresh for schema migrations. The primary use case: test a database migration against a current production clone before running it against production. Previously this required a snapshot workflow with manual orchestration. Now it’s a RAM share and a clone call, triggerable from a CI pipeline step.

One constraint that matters: Copies must reside in the same Availability Zone as the source volume. Cross-region and cross-AZ test environments require the snapshot path. Audit your architecture before building automation around Volume Clones — if your test VPCs live in a different AZ than production, this workflow doesn’t apply to you yet.

KMS key handling: Source volumes using customer-managed KMS keys require the key to be shared with the target account or re-encrypted during copy using a key the target account controls. Add one IAM policy update to the setup. Volumes using AWS-managed keys cannot be shared cross-account at all — customer-managed or unencrypted volumes only.

Pricing: AWS charges a one-time copy fee based on volume size, charged to the target account. No cost for sharing via RAM. Copied volumes incur standard EBS charges from that point forward.

Source: AWS Blog

Content created with AI assistance and reviewed for accuracy.