AWS Enables Cross-Account EBS Volume Cloning with KMS Re-Encryption

Amazon Web Services has expanded Amazon EBS Volume Clones to support cross-account copying with in-flight AWS Key Management Service (AWS KMS) re-encryption. Organizations can now share an EBS volume with target accounts using AWS Resource Access Manager (AWS RAM) and create point-in-time volume clones directly within the target account in the same Availability Zone. The target account can specify its own customer-managed KMS key to re-encrypt the block storage upon creation. The capability supports unencrypted volumes and volumes encrypted with customer-managed keys across all commercial, GovCloud, and China regions. This release matters because enterprise cloud architectures universally isolate production, staging, and developer sandboxes across distinct AWS accounts. Historically, populating lower environments with realistic production-scale block data required initiating snapshot exports, granting cross-account snapshot permissions, copying snapshots, and then restoring them into new EBS volumes. This traditional process introduced substantial data hydration delays, operational overhead, and key-sharing complexities. Cross-account EBS cloning eliminates this friction, allowing developers to provision ready-to-test database and application state in isolated environments within minutes, rather than waiting hours for snapshot restoration pipelines to finish. From an architectural perspective, this launch fits into the broader cloud trend of decoupling storage lifecycle management from single-account silos while strengthening cryptographic boundaries. As organizations adopt multi-account Landing Zone architectures and zero-trust security postures, sharing raw KMS keys across environments is increasingly prohibited by compliance frameworks. By integrating AWS RAM sharing with native KMS re-encryption during the cloning process, AWS provides a declarative control plane that respects organizational guardrails without forcing platform teams to build and maintain bespoke data-scrubbing and replication workflows. In practice, DevOps and platform engineers should update their staging provisioning automation to replace legacy snapshot-and-restore scripts with RAM-based volume clone workflows. Security teams should verify IAM and RAM policies to govern which accounts can request production volume shares and ensure that target accounts enforce proper customer-managed keys (CMKs). Note that volumes encrypted with AWS-managed default keys cannot be shared across accounts, so infrastructure teams must migrate legacy default-encrypted volumes to customer-managed keys before taking advantage of cross-account cloning workflows.