What happens when you copy an encrypted EC2 AMI across Regions?

Copying an encrypted Amazon Elastic Compute Cloud (EC2) Amazon Machine Image (AMI) from one AWS Region to another results in a new, distinct AMI in the destination Region with a unique AMI ID. During this process, AWS automatically copies the underlying Amazon Elastic Block Store (EBS) snapshots to the target Region and re-encrypts them using a KMS key located in that destination Region. Because AWS Key Management Service (KMS) keys are generally regional resources, the copied AMI cannot continue using a standard single-Region KMS key from the source Region and must instead use either the default AWS-managed EBS key in the target Region, a specified customer-managed key in the target Region, or a replica of a multi-Region KMS key.

How the Cross-Region AMI Copy Process Works

An Amazon Machine Image consists of metadata regarding the instance configuration and pointers to one or more Amazon EBS snapshots that hold the actual volume data. When you initiate a copy of an encrypted AMI to another Region, AWS performs several operations behind the scenes:

  1. Snapshot Duplication and Re-encryption: AWS reads the source EBS snapshots—decrypting the data using the source Region's KMS key—and securely transfers the snapshot data over the AWS network to the destination Region. As the data arrives in the destination Region, it is encrypted using a KMS key residing in that destination Region.
  2. New Snapshot Creation: New EBS snapshots are created in the target Region with new Snapshot IDs. If the first cross-Region copy is performed, it is always a full copy of the blocks in the snapshot rather than an incremental copy, unless there is already a previous snapshot of the same volume in the destination Region.
  3. AMI Registration: Once the underlying snapshots are created and encrypted in the destination Region, AWS registers a new AMI in the target Region with its own unique ami-xxxxxxxx identifier.

Key Management Service (KMS) Key Behavior

Because KMS encryption keys are bound to the Region in which they were created, you must consider which KMS key will encrypt the new AMI in the destination Region:

  • Default Encryption Behavior: If you copy an encrypted AMI and do not explicitly specify a KMS key for the destination Region, AWS automatically encrypts the target AMI's snapshots using the default AWS-managed KMS key for Amazon EBS (aws/ebs) in the destination Region.
  • Custom KMS Key Specification: You can choose to specify a customer-managed KMS key (CMK) that exists in the destination Region. This is mandatory if you plan to share the copied AMI with other AWS accounts later, as AWS does not allow sharing AMIs or snapshots encrypted with the default aws/ebs managed key.
  • Multi-Region KMS Keys: If you use AWS KMS multi-Region keys, you can create a replica of your primary KMS key in the destination Region. While the replica key has the same Key ID and key material as the primary key in the source Region, it still has a distinct Amazon Resource Name (ARN) specific to the destination Region, which you can select during the copy operation.

IAM and KMS Permissions Required

To successfully copy an encrypted AMI across Regions, the IAM principal (user or role) initiating the copy action in the destination Region must have permissions in both Regions:

Source Region Permissions

  • EC2 Permissions: ec2:DescribeImages and ec2:DescribeSnapshots to read the source AMI and its backing snapshots.
  • KMS Permissions: kms:Decrypt and kms:DescribeKey on the KMS key used to encrypt the source AMI snapshots so AWS can read and transfer the data.

Destination Region Permissions

  • EC2 Permissions: ec2:CopyImage, ec2:CopySnapshot, ec2:CreateImage, and ec2:RegisterImage (along with ec2:CreateTags if copying or applying tags).
  • KMS Permissions: kms:Encrypt, kms:ReEncrypt*, kms:GenerateDataKeyWithoutPlaintext, kms:DescribeKey, and kms:CreateGrant on the destination Region's KMS key so Amazon EBS can encrypt the newly created snapshots.

What Does and Does Not Get Copied

When an encrypted AMI is copied across Regions, not all attributes associated with the original AMI are carried over to the new AMI:

  • AMI ID and Snapshot IDs: The target AMI and its backing snapshots receive completely new IDs. Any infrastructure-as-code templates (like AWS CloudFormation or Terraform) must reference the new Region-specific AMI ID.
  • User-Defined Tags: Tags attached to the source AMI are not copied by default. However, you can opt to copy user-defined tags by enabling the CopyImageTags parameter during the copy request, or by applying new tags during the operation.
  • Launch Permissions: Launch permissions (which control which AWS accounts can launch instances from the AMI) are not copied. The new AMI is private to your account by default in the destination Region.
  • Billing Product Codes: Any AWS Marketplace billing product codes associated with the source AMI are preserved on the target AMI, though certain AWS Marketplace AMIs may restrict cross-Region copying entirely.
  • Deprecation Time: Any deprecation settings configured on the original AMI are not transferred and must be reapplied in the destination Region if desired.

Cost and Performance Considerations

Copying an encrypted AMI to another Region incurs standard AWS charges and operational considerations:

  • Data Transfer Costs: You are billed for cross-Region data transfer out from the source Region to the destination Region based on the size of the data transferred.
  • EBS Snapshot Storage Costs: Once the snapshots are stored in the destination Region, you incur standard monthly Amazon EBS snapshot storage charges for that Region.
  • KMS API Costs: Both the source and destination KMS keys will process cryptographic API requests (Decrypt, GenerateDataKeyWithoutPlaintext, CreateGrant) during the copy process, which count toward your AWS KMS usage.
  • Copy Duration: Because the initial copy of a snapshot to a new Region is a full copy rather than an incremental one, the time required to complete the AMI copy depends on the total amount of data stored in the backing snapshots. Subsequent copies of updated AMIs derived from the same base volume to the same destination Region will only transfer changed blocks, reducing both transfer time and cost.