AWS ebs: Clarify Local Zone snapshot encryption key behavior

Service: ebs · 2026-09-27 · Documentation low

File: ebs/latest/userguide/snapshots-localzones.md · Type: encryption

Summary

Replaces the Local Zone snapshot encryption paragraph with a pointer to the Local Zones/Outposts/Wavelength encryption page, clarifying that volumes from local snapshots use the same KMS key as the snapshot but the key can be changed when copying a local snapshot.

Security assessment

The change clarifies KMS key usage for Local Zone snapshots and cross-references the encryption documentation; it is encryption guidance, not a specific vulnerability fix.

Evidence

+See [Amazon EBS encryption in Local Zones, Outposts, and Wavelength Zones](./ebs-encryption-local-zones-outposts-wavelength.html) for Local Zone-specific encryption behavior. In Local Zones where Amazon EBS resources are encrypted by default, volumes created from local snapshots are always encrypted using the same AWS KMS key as the snapshot. However, you can change the encryption key when you copy a local snapshot.

Diff

diff --git a/ebs/latest/userguide/snapshots-localzones.md b/ebs/latest/userguide/snapshots-localzones.md
index e71c142b6..2eb7495f9 100644
--- a//ebs/latest/userguide/snapshots-localzones.md
+++ b//ebs/latest/userguide/snapshots-localzones.md
@@ -70 +70 @@ You can use Local snapshots in Local Zones to create Amazon EBS volumes in the s
-Local snapshots can be unencrypted or encrypted by default. When encrypted by default, Local snapshots are encrypted using the same AWS KMS key as the source Amazon EBS volume. When you create a volume from a Local snapshot, you can't re-encrypt the volume using a different KMS key. Volumes created from Local snapshots must be encrypted using the same AWS KMS key as the source snapshot.
+See [Amazon EBS encryption in Local Zones, Outposts, and Wavelength Zones](./ebs-encryption-local-zones-outposts-wavelength.html) for Local Zone-specific encryption behavior. In Local Zones where Amazon EBS resources are encrypted by default, volumes created from local snapshots are always encrypted using the same AWS KMS key as the snapshot. However, you can change the encryption key when you copy a local snapshot.