Amazon EBS now supports additional resource-level permissions for copying EBS snapshots

Amazon Elastic Block Store (Amazon EBS) now supports additional resource-level permissions for copying EBS snapshots. When moving your data across Regions, accounts, and Availability Zones, you can copy any snapshot accessible to you to another Region or account, including snapshots created by you or shared with you. With this launch, you have more granular controls to set resource-level permissions for the snapshot copy and selection of the source snapshot. This allows you to control the IAM identities that can copy EBS snapshot from source snapshots, and the conditions that they can use these source snapshots for the snapshot copy operation.

To meet your specific permission needs on the source snapshots, you can also specify any of 6 EC2-specific condition keys for your CopySnapshot action in your IAM policy: ec2:Encrypted, ec2:VolumeSize, ec2:Owner, ec2:ParentVolume, ec2:SnapshotTime, and ec2:ParentSnapshot. Additionally, you can use global condition keys for the source snapshot.

This new resource-level permission model is available in all AWS Regions where EBS snapshots are available. To learn more about using resource-level permissions to copy EBS snapshot, or transitioning to the new resource-level permission model from previous permission model, please visit the launch blog. For more information about Amazon EBS, please visit the product page.