AWS ebs medium security documentation change

Service: ebs · 2025-05-16 · Security-related medium

File: ebs/latest/userguide/ebs-copy-snapshot.md

Summary

Updated documentation for copying snapshots, including encryption requirements, error handling for missing KMS key permissions, and added CLI/PowerShell examples for cross-region and encrypted snapshot copies.

Security assessment

The changes explicitly address security implications of copying encrypted snapshots without proper KMS key permissions, including error states and required access controls. The addition of 'Given key ID is not accessible' error documentation highlights a security-related failure mode.

Diff

diff --git a/ebs/latest/userguide/ebs-copy-snapshot.md b/ebs/latest/userguide/ebs-copy-snapshot.md
index 276faf5c6..503efff7c 100644
--- a//ebs/latest/userguide/ebs-copy-snapshot.md
+++ b//ebs/latest/userguide/ebs-copy-snapshot.md
@@ -156 +156 @@ Enabled | Encrypted | Automatically encrypted | You can specify the KMS key to u
-To copy a snapshot, use one of the following methods.
+You can copy snapshots from one Region to another. You can copy an unencrypted snapshot to an encrypted snapshot. However, if you attempt to copy an encrypted snapshot without having permissions to use the encryption key, the operation fails silently and the snapshot copy receives the "Given key ID is not accessible" status message.
@@ -161 +161 @@ Console
-###### To copy a snapshot using the console
+###### To copy a snapshot
@@ -194 +194 @@ If the source snapshot is encrypted, or if your account is enabled for [encrypti
-###### Note
+AWS CLI
@@ -196 +195,0 @@ If the source snapshot is encrypted, or if your account is enabled for [encrypti
-If you attempt to copy an encrypted snapshot without having permissions to use the encryption key, the operation fails silently. The error state is not displayed in the console until you refresh the page.
@@ -198 +197 @@ If you attempt to copy an encrypted snapshot without having permissions to use t
-AWS CLI
+###### To copy a snapshot to another Region
@@ -199,0 +199 @@ AWS CLI
+Use the [copy-snapshot](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-snapshot.html) command. The following example copies the specified snapshot from the source Region to the current Region, which is specified by the `--region` option.
@@ -201 +200,0 @@ AWS CLI
-###### To copy a snapshot using the AWS CLI
@@ -203 +202,4 @@ AWS CLI
-Use the [copy-snapshot](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-snapshot.html) command.
+    aws ec2 copy-snapshot \
+        --source-snapshot-id snap-0abcdef1234567890 \
+        --source-region us-east-1 \
+        --region us-west-2
@@ -205 +207 @@ Use the [copy-snapshot](https://awscli.amazonaws.com/v2/documentation/api/latest
-###### To copy a snapshot using the Tools for Windows PowerShell
+###### To copy an unencrypted snapshot to an encrypted snapshot
@@ -207 +209,25 @@ Use the [copy-snapshot](https://awscli.amazonaws.com/v2/documentation/api/latest
-Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Snapshot.html) command.
+Use the [copy-snapshot](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/copy-snapshot.html) command. The following example copies the specified unencrypted snapshot from the source Region to the current Region, encrypting the new snapshot using the specified KMS key.
+    
+    
+    aws ec2 copy-snapshot \
+        --source-snapshot-id snap-0abcdef1234567890 \
+        --source-region us-east-1 \
+        --encrypted \
+        --kms-key-id alias/my-kms-key
+
+PowerShell
+    
+
+###### To copy a snapshot to another Region
+
+Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Snapshot.html) cmdlet. The following example copies the specified snapshot from the source Region to the current Region, which is specified by the `--region` option.
+    
+    
+     Copy-EC2Snapshot `
+        -SourceSnapshotId snap-0abcdef1234567890 `
+        -SourceRegion us-east-1 `
+        -Region us-west-2
+
+###### To copy an unencrypted snapshot to an encrypted snapshot
+
+Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Snapshot.html) cmdlet. The following example copies the specified unencrypted snapshot from the source Region to the current Region, encrypting the new snapshot using the specified KMS key.
@@ -209 +234,0 @@ Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/referen
-###### Note
@@ -211 +236,5 @@ Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/referen
-If you attempt to copy an encrypted snapshot without having permissions to use the encryption key, the operation fails silently and the snapshot copy receives the **`"Given key ID is not accessible"`** status message.
+     Copy-EC2Snapshot `
+        -SourceSnapshotId snap-0abcdef1234567890 `
+        -SourceRegion us-east-1 `
+        -Encrypted $true `
+        -KmsKeyId alias/my-kms-key