Review snapshot and key permissions before sharing encrypted EBS data

Sharing a snapshot grants access to its complete contents.

Source facts

An EBS snapshot share exposes all data in that snapshot to the authorized recipient. Encrypted snapshots cannot be shared publicly and require a customer managed key for sharing; the default AWS managed key is not eligible. Sharing an encrypted snapshot also requires access to its associated customer managed key.

Source: AWS Documentation.

Applicability

This applies to sharing EBS snapshots across AWS accounts, with Region and encryption restrictions in the reference.

DSE recommendation

DSE recommends reviewing the entire captured dataset before approving a share, including credentials or customer data that may exist outside the intended folder. Confirm the receiving account ID through the approved process. Coordinate snapshot and key permissions with both owners and document the revocation procedure. Prefer an intentionally prepared sanitized dataset when support does not need the full disk. Record the snapshot identity, Region, key and business purpose so later reviews can identify why the recipient received access. Give the data owner an explicit approval question: may this account receive the entire captured volume? Require a separate key-access review and record how the recipient will protect any authorized derivative copy before choosing this route for support or migration.

Verification

Proposed verification: use a non-sensitive test snapshot to confirm the intended recipient can create an authorized volume while an unapproved account cannot. Inspect both snapshot sharing and key policy state. Confirm the actual data scope and key eligibility before approving a production snapshot.

Official reference

AWS Documentation. Reviewed October 20, 2026.