How to Share a Private EC2 AMI with Another AWS Account?

Sharing a privately created Amazon EC2 AMI with another AWS account requires modifying the AMI launch permissions to grant explicit access to the target 12-digit AWS account ID and configuring permissions for the underlying EBS snapshots and customer-managed KMS encryption keys. By scoping permissions exclusively to specific AWS account numbers rather than making the image public, organizations can securely distribute golden images across multi-account environments while maintaining strict access boundaries. This guide covers the prerequisites, encryption requirements, step-by-step instructions for the AWS Management Console and AWS CLI, and security best practices for cross-account AMI sharing.

Prerequisites for Secure Cross-Account AMI Sharing

Before sharing an Amazon Machine Image (AMI) with another account, verify the following details:

  1. Target AWS Account ID: You need the 12-digit AWS account ID of the recipient account.
  2. Region Alignment: AMIs are regional resources. Cross-account sharing only grants access within the AWS Region where the AMI currently resides. If the recipient needs the AMI in a different Region, you must either copy the AMI to that Region before sharing or grant the recipient permissions to copy it themselves.
  3. Encryption Key Type (Critical for Encrypted AMIs): If the AMI's backing Amazon EBS snapshots are encrypted using the default AWS-managed key (aws/ebs), you cannot share the AMI with another account. You must first copy the AMI and re-encrypt it with a customer-managed AWS KMS key.

Preparing Encrypted AMIs and KMS Permissions

For security compliance, most production AMIs use encrypted EBS volumes. Sharing an encrypted AMI across AWS accounts requires granting the target account access to both the AMI launch permissions and the customer-managed KMS key used to encrypt the underlying EBS snapshots.

Step 1: Ensure a Customer-Managed KMS Key is Used

If your private AMI was encrypted with the default aws/ebs KMS key, create a new customer-managed key (CMK) in AWS Key Management Service (KMS) and copy the AMI using that key:

aws ec2 copy-image \
    --source-region us-east-1 \
    --source-image-id ami-0123456789abcdef0 \
    --name "Encrypted-Golden-AMI-Shareable" \
    --encrypted \
    --kms-key-id arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab

Step 2: Update the KMS Key Policy for the Target Account

The source account (111122223333) must update the key policy of the customer-managed KMS key to allow the target account (444455556666) to perform cryptographic operations needed to launch instances or copy the AMI. Add the following statement to your KMS key policy:

{
    "Sid": "AllowTargetAccountToUseKMSKeyForAMI",
    "Effect": "Allow",
    "Principal": {
        "AWS": "arn:aws:iam::444455556666:root"
    },
    "Action": [
        "kms:Decrypt",
        "kms:ReEncrypt*",
        "kms:GenerateDataKey*",
        "kms:CreateGrant",
        "kms:DescribeKey"
    ],
    "Resource": "*",
    "Condition": {
        "Bool": {
            "kms:GrantIsForAWSResource": "true"
        }
    }
}

Adding the kms:GrantIsForAWSResource condition restricts kms:CreateGrant so the target account can only create grants when integrated AWS services (like Amazon EC2/EBS) request them on its behalf.

Step 3: Configure IAM Permissions in the Target Account

Designating the target account's root principal in the source KMS key policy delegates authority to the target account's IAM administrators. An IAM user or role in the target account still needs an identity-based IAM policy permitting access to the source account's KMS key:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowUseOfSharedKMSKeyForEC2Launch",
            "Effect": "Allow",
            "Action": [
                "kms:Decrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*",
                "kms:CreateGrant",
                "kms:DescribeKey"
            ],
            "Resource": [
                "arn:aws:kms:us-east-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab"
            ]
        }
    ]
}

Sharing the AMI Using the AWS Management Console

To share the AMI with a specific AWS account via the console:

  1. Sign in to the AWS Management Console in the source account and open the Amazon EC2 console.
  2. In the left navigation pane, under Images, select AMIs.
  3. Choose the filter Owned by me and select the private AMI you want to share.
  4. Select the Permissions tab in the bottom detail pane and click Edit AMI permissions.
  5. Keep the AMI visibility set to Private.
  6. Under Shared accounts, choose Add account ID.
  7. Enter the 12-digit AWS account ID of the target account.
  8. If you want the target account to be able to copy the AMI to their own account or another Region, select the checkbox Add 'Create volume' permissions to the following associated snapshots when creating permissions.
  9. Click Save changes.

Sharing the AMI Using the AWS CLI

You can automate secure AMI sharing using the modify-image-attribute command.

Granting Launch Permissions

Run the following command to allow account 444455556666 to launch EC2 instances from ami-0123456789abcdef0:

aws ec2 modify-image-attribute \
    --image-id ami-0123456789abcdef0 \
    --launch-permission "Add=[{UserId=444455556666}]"

Sharing Underlying EBS Snapshot Permissions (Required to Copy the AMI)

Launching an instance only requires AMI launch permissions (and KMS permissions if encrypted). However, if the target account needs to copy the AMI (ec2:CopyImage) to own an independent copy, you must also share the createVolumePermission on every EBS snapshot backing the AMI:

aws ec2 modify-snapshot-attribute \
    --snapshot-id snap-0abcdef1234567890 \
    --attribute createVolumePermission \
    --operation-type add \
    --user-ids 444455556666

Verifying and Revoking Shared Permissions

To audit which accounts currently have access to your AMI:

aws ec2 describe-image-attribute \
    --image-id ami-0123456789abcdef0 \
    --attribute launchPermission

To revoke access from the target account when it is no longer needed:

aws ec2 modify-image-attribute \
    --image-id ami-0123456789abcdef0 \
    --launch-permission "Remove=[{UserId=444455556666}]"

Sharing Across an AWS Organization

If you are sharing AMIs across multiple accounts within the same AWS Organization, you can share the AMI with an entire Organization ARN or Organizational Unit (OU) ARN instead of managing individual 12-digit account IDs:

aws ec2 modify-image-attribute \
    --image-id ami-0123456789abcdef0 \
    --launch-permission "Add=[{OrganizationArn=arn:aws:organizations::111122223333:organization/o-exampleorgid}]"

Security Best Practices for Sharing Private AMIs

  1. Sanitize Sensitive Data Before Creating the AMI: Before creating an AMI to share, remove SSH authorized_keys, temporary credentials, shell command history (.bash_history), application secrets, and private certificates from the source instance.
  2. Enable Block Public Access for AMIs: Enable Block public access for AMIs at the account level (aws ec2 enable-image-block-public-access --image-block-public-access-state block-new-sharing) to prevent accidental public exposure while still permitting explicit cross-account sharing.
  3. Restrict Who Can Share AMIs via IAM Condition Keys: Use the ec2:AddLaunchPermission condition or Service Control Policies (SCPs) to ensure administrators cannot set "Group": "all" (public access) when modifying image attributes.
  4. Automate with EC2 Image Builder: Use AWS EC2 Image Builder alongside AWS Resource Access Manager (AWS RAM) to build, harden, test, and distribute encrypted golden AMIs across accounts with auditable pipelines.