AWS has expanded the Amazon EBS Volume Clones feature to enable copying storage volumes between different AWS accounts, whereas previously point-in-time copies were limited to the same account within the same Availability Zone. The target account can re-encrypt the copy using a key from its AWS Key Management Service (AWS KMS).
The new capability targets development and testing scenarios that require current application data without keeping non-production environments in the same account as the production environment. According to AWS, for example, a copy of the production environment can be used to update development and testing environments located in separate accounts, while applying the required encryption settings in the target account.
How does the copying process work?
The EBS volume owner begins by granting the target account access to the volume through AWS Resource Access Manager (AWS RAM), either by adding the volume to an existing resource share or by creating a new share. The target account must then accept the resource share from the RAM console.
After acceptance is complete, the shared volume appears on the EBS Volumes page for the target account, where Copy volume can be selected to create the copy. AWS also provides monitoring events through AWS CloudTrail and Amazon EventBridge; the start of the operation can be tracked, followed by its completion when the copied volume changes from initializing to completed. The event data includes the shared volume ID, the consumer account ID, and the event time.
Encryption and location restrictions
Unencrypted volumes or volumes encrypted using a customer-managed key (CMK) can be shared. Volumes encrypted with the default AWS managed key cannot be shared this way. If the source volume is encrypted using a CMK, the key must also be shared with the target account. When creating the copy, a different CMK can be specified to re-encrypt it within the target account.
The feature does not allow the copy to be moved to a different Availability Zone; the copy must be created in the same Availability Zone as the source volume. To identify the exact physical location across accounts, AWS recommends using Availability Zone IDs such as use1-az1 rather than relying solely on logical Zone names.
What changes in practice?
The most important change is separating EBS data sharing from the production account while keeping the copying workflow subject to clear approvals through AWS RAM. This gives development and testing teams a direct way to obtain a current copy, but it does not eliminate the need to review sharing permissions and KMS keys before starting the operation, particularly because access to the volume and the key require separate arrangements.
A one-time fee is charged for the copying operation based on the volume size and is billed to the account where the copy will reside, while AWS does not charge fees for sharing EBS volumes through AWS RAM. After creation, the copy begins incurring standard EBS volume charges. The feature is available in all AWS Regions that support Amazon EBS Volume Clones and can be run from the Amazon EC2 console. AWS also notes that AWS MCP Server and its related extensions can be used to handle sharing and copying programmatically through AI-assisted programming tools.