# Copy an Amazon EBS snapshot After you create a snapshot, and it has reached the `completed` state, you can create a copy of it. The snapshot copy is an exact copy of the original, but it has a unique resource ID. You can copy snapshots that you own and snapshots that are shared with you, privately or publicly. You might need to copy a snapshot for the following use cases: + Geographic expansion — You need to launch your applications in a new Region. + Migration — You need to move an application to a new destination, to enable better availability or to minimize cost. + Disaster recovery — You need to back up your data and logs to secondary Regions for data redundancy purposes. + Encryption — You need to encrypt a previously unencrypted snapshot or reencrypt an encrypted snapshot using a different KMS key. + Copy a shared snapshot — You need to copy a snapshot that is shared with you. + Data retention and auditing requirements — You need to copy encrypted snapshots from one AWS account to another to preserve data for auditing or data retention. Using a different account protects you if your main AWS account is compromised. To copy multi-volume snapshots, identify all of the snapshots that are part of that set using the tags that you assigned during creation, and then copy them individually. For information about copying an Amazon RDS snapshot, see [Copying a DB Snapshot](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_CopySnapshot.html) in the *Amazon RDS User Guide*. **Pricing** For pricing information about copying snapshots, see [Amazon EBS Pricing](https://aws.amazon.com/ebs/pricing/). **Topics** + [Considerations for copying snapshots](#snapshot-copy-consids) + [Destinations for snapshot copies](#snapshot-copy-destinations) + [Incremental snapshot copying](#ebs-incremental-copy) + [Time-based copies](time-based-copies.md) + [Encryption and snapshot copying](#creating-encrypted-snapshots) + [Copy a snapshot](#ebs-snapshot-copy) ## Considerations for copying snapshots + You can copy AWS Marketplace, VM Import/Export, and Storage Gateway snapshots, but you must verify that the snapshot is supported in the destination Region. + There is a limit of `20` concurrent snapshot copy requests per destination. If you exceed this quota, you receive a `ResourceLimitExceeded` error. If you receive this error, wait for one or more of the copy requests to complete before making a new snapshot copy request. + User-defined tags are not copied from the source snapshot to the snapshot copy. You can add user-defined tags during or after the copy operation. + Snapshots created by a snapshot copy operation have an arbitrary volume ID, such as `vol-ffff` or `vol-ffffffff`. These arbitrary volume IDs should not be used for any purpose. + Resource-level permissions specified for the snapshot copy operation can apply to the snapshot copy and the source snapshot. For an example, see [ Example: Copying snapshots](https://docs.aws.amazon.com/ebs/latest/userguide/security_iam_id-based-policy-examples.html#iam-copy-snapshot). + If you copy a snapshot that is enabled for fast snapshot restore, the snapshot copy is not automatically enabled for fast snapshot restore. You must explicitly enable fast snapshot restore for the snapshot copy. + If you copy a snapshot and encrypt it to a new KMS key, a complete (non-incremental) copy is created. This results in additional storage costs. + If you copy a snapshot to a new Region, a full (non-incremental) copy is created. This results in additional storage costs. + If you use external or cross-Region data transfers, additional [EC2 data transfer](https://aws.amazon.com/ebs/pricing/) charges will apply. If you delete any snapshots after initiation, you are still charged for the data that has already been transferred. ## Destinations for snapshot copies The location of the source snapshot determines whether you can copy it or not. + If the source snapshot is in a Region, you can copy it within that Region, to another Region, to an Outpost associated with that Region, or to a Local Zone in that Region. + If the source snapshot is in a Local Zone, you can copy it within the same Local Zone, to another Local Zone in the same zone group, or to the parent Region of that Local Zone. + If the source snapshot is on an Outpost, you can't copy it. ## Incremental snapshot copying Snapshot copy operations within the same account and Region using the same KMS key are always incremental copies. However, if you encrypt the snapshot copy using a different KMS key, the copy is a full copy. When you copy a snapshot across Regions or accounts, the copy is an incremental copy if the following conditions are met: + The snapshot was copied to the destination Region or account previously. + The most recent snapshot copy still exists in the destination Region or account. + The most recent snapshot copy has not been archived. + All copies of the snapshot in the destination Region or account are either unencrypted or were encrypted using the same KMS key. **Tip** We recommend that you tag your snapshot copies with the volume ID and creation time so that you can keep track of the most recent snapshot copy of a volume in the destination Region or account. To see whether your snapshot copies are incremental, check the [copySnapshot](ebs-cloud-watch-events.md#copy-snapshot-complete) CloudWatch event. # Time-based copies for Amazon EBS snapshots and EBS-backed AMIs Time-based copies can help you meet compliance or business requirements for data replication by ensuring that your EBS snapshots and EBS-backed AMIs are copied, within and across AWS Regions, in a specified timeframe. Time-based copies can also help backup administrators meet stringent disaster recovery requirements (Recovery Point Objectives and Recovery Time Objectives), and it improves development agility by ensuring predictable copying times for snapshots and EBS-backed AMIs. With time-based snapshot and EBS-backed AMI copy operations, you specify a completion duration, between 15 minutes and 48 hours, in which the copy is to be completed. The completion duration must be specified in 15 minute increments. **Topics** + [Quotas](#time-based-copies-quota) + [Determine your completion duration](#time-based-copies-how) + [Considerations](#time-based-copies-considerations) + [Monitoring](#time-based-copies-monitoring) + [Pricing and billing](#time-based-copies-pricing) ## Quotas The following quotas apply to time-based snapshot and EBS-backed AMI copy operations: | Quota | Description | Quota value | Adjustable | | --- | --- | --- | --- | | Snapshot copy operation throughput quota | The maximum throughput that can be achieved by a single time-based snapshot copy operation. For AMI copy operations, the quota applies to each individual snapshot associated with the AMI. | 500 MiB/s | No | | Cumulative snapshot copy throughput quota | The maximum cumulative throughput that can be achieved by concurrent time-based snapshot copy operations between a source and destination Region. For AMI copy operations, each individual snapshot associated with the AMI counts towards the quota. | 2,000 MiB/s | [Yes](https://console.aws.amazon.com/servicequotas/home/services/ebs/quotas/L-E137849C) | When you initiate a **time-based snapshot copy operation**, you specify a completion duration. The throughput used by the request is determined by the size of the snapshot data and the requested completion duration. For example, if you copy a snapshot that has 225,000 MiB (0.214 TiB) of data, and you request a completion duration of 15 minutes, the throughput is 250 MiB/s (225,000 MiB ÷ 15 minutes = 250 MiB/s). When you initiate a **time-based AMI copy operation**, the completion duration you specify applies to each snapshot associated with the AMI. Because each snapshot can have a different size, each snapshot is copied at a different throughput to ensure that all snapshots are copied within the completion duration. For example, say you have an AMI with the following associated snapshots: + Snapshot 1: 200,000 MiB + Snapshot 2: 500,000 MiB + Snapshot 3: 450,000 MiB If you initiate a time-based copy for this AMI and specify a completion duration of 60 minutes, the request uses the following throughput: + Snapshot 1: 55.56 MiB/s (200,000 MiB ÷ 60 minutes = 55.56 MiB/s) + Snapshot 2: 138.89 MiB/s (500,000 MiB ÷ 60 minutes = 138.89 MiB/s) + Snapshot 3: 125 MiB/s (450,000 MiB ÷ 60 minutes = 125 MiB/s) This means that the request uses 319.45 MiB/s of your cumulative snapshot copy throughput quota to ensure that the copy completes in 60 minutes. If you initiate a time-based snapshot or EBS-backed AMI copy request and your available cumulative snapshot copy throughput quota is: + greater than or equal to the required throughput rate, the copy completes within the requested completion duration. + less than the required throughput rate but greater than zero, the request succeeds but it will take longer than you requested. The copy is completed using your available throughput quota. + zero (quota reached), the request fails. ## Determine your completion duration The minimum completion duration you can request for a time-based snapshot or EBS-backed AMI copy operation is 15 minutes, and the maximum completion duration you can request is 48 hours. The completion duration must be specified in 15 minute increments. **Concurrent time-based snapshot copy operations** You can perform concurrent time-based snapshot copy operations between the same source and destination Regions, as long as the combined throughput of all of the concurrent operations is within your cumulative snapshot copy throughput quota (2,000 MiB/s by default). To determine whether you can achieve your required completion duration for your existing snapshots, divide the combined size of all of your snapshots by your required completion duration to determine the required throughput rate. **Tip** If you don't know the exact size of the data in your snapshots, you can use the full snapshot size as a proxy instead. To get the full snapshot size, use the [ describe-snapshots](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html) AWS CLI command. ``` required throughput rate = combined snapshot size ÷ required completion duration ``` If the required throughput rate is less than your cumulative snapshot copy throughput quota, you can achieve your required completion duration. If the required throughput rate is greater than your cumulative snapshot copy throughput quota, we recommend that you request a quota increase that is at least 10% higher than your required throughput rate. **Tip** The Amazon EC2 console provides a calculator that you can use to check how much snapshot data you copied between two Regions over a specific period, and the minimum achievable completion duration that you can achieve for that amount of data, based on a specific cumulative snapshot copy throughput quota. The calculator uses the `SnapshotCopyBytesTransferred` CloudWatch metric to calculate data copied between two Regions over a period. To open the calculator, in the Amazon EC2 console navigation panel, select **Snapshots**, and then choose **Actions**, **Launch copy duration calculator**. The snapshot copy duration calculator are not supported with AWS Outposts, Local Zones, and Wavelength Zones. **Individual time-based snapshot copy operations** You can calculate the minimum completion duration for an individual time-based snapshot copy operation by dividing the size of the snapshot data by the snapshot copy operation throughput quota (500 MiB/s). **Tip** If you don't know the exact size of the data in your snapshots, you can use the full snapshot size as a proxy instead. To get the full snapshot size, use the [ describe-snapshots](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html) AWS CLI command. ``` minimum completion duration = Max(15 minutes, (snapshot data size ÷ 500 MiB/s) ``` For example, the minimum completion duration for a snapshot with 900,000 MiB of data is 30 minutes. ``` minimum completion duration = Max(15 minutes, (900,000 MiB ÷ 500 MiB/s) = Max(15 minutes, 30 minutes) = 30 minutes ``` **Time-based AMI copy operations** When you initiate a time-based AMI copy operation for an EBS-backed AMI with a single associated snapshot, it behaves in the same way as an **individual time-based snapshot copy operation**, and the same throughput limitations apply. When you initiate a time-based AMI copy operation for an EBS-backed AMI with a multiple associated snapshots, it behaves in the same way as **concurrent time-based snapshot copy operations** and the same throughput limitations apply. Each associated snapshot results in a separate snapshot copy request, each of which contributes to your cumulative snapshot copy throughput quota. The completion duration that you specify applies to each associated snapshot. ## Considerations + You can initiate time-based snapshot and EBS-backed AMI copy operations when copying snapshots within the same Region or when copying snapshots across Regions. + If you initiate two time-based copy operations for the same snapshot or AMI, the second copy operation's completion duration starts only after the first copy operation completes. + Time-based copy operations and the snapshot copy duration calculator are not supported with AWS Outposts, Local Zones, and Wavelength Zones. ## Monitoring You can monitor the progress of time-based snapshot and EBS-backed AMI copy operations using the Amazon EC2 console and the AWS CLI. In the console, select the snapshot and then, in the **Details tab**, inspect the ** Progress** field. With the AWS CLI, inspect the `Progress` output element in the [ describe-snapshots](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-snapshots.html) command response. You can check whether a time-based snapshot or EBS-backed AMI copy operation completed within the requested completion duration by checking the difference between the **Started** and **Completed** times in the console, or `StartTime` and `CompletionTime` in the `describe-snapshots` response. You can also use the `copySnapshot` Amazon EventBridge event to monitor the outcome of time-based copy operations. The event indicates whether the operation completed and whether the requested completion duration was met. If the completion duration was not met, the event includes more information about the cause. For more information, see [EBS snapshot events](ebs-cloud-watch-events.md#snapshot-events). ## Pricing and billing **Note** Similar to standard snapshot copy operations, if you copy a snapshot to a new Region, a full (non-incremental) copy is created, which results in additional storage costs. Subsequent copies of the same snapshot are incremental. Additionally, if you use external or cross-region data transfers, additional Amazon EC2 data transfer charges will apply. Additional charges apply for time-based snapshot and EBS-backed AMI copy operations. Time-based copy operations are charged at a rate that is based on the requested completion duration, per GiB of snapshot data copied. The fixed rates are as follows: **Note** The completion duration must be specified in 15 minute increments. The minimum completion duration is 15 minutes, and the maximum is 48 hours. + 15 minutes — \$10.020 per GiB of data + 30 minutes and 45 minutes — \$10.018 per GiB of data + 1 hour to 1 hour 45 minutes — \$10.016 per GiB of data + 2 hours to 3 hours 45 minutes — \$10.014 per GiB of data + 4 hours to 7 hours 45 minutes — \$10.012 per GiB of data + 8 hours to 15 hours 45 minutes — \$10.010 per GiB of data + 16 hours or more — \$10.005 per GiB of data For example, if you copy a snapshot with 3,000 GiB of data with a completion duration of 8 hours, you are billed \$130 (\$10.010 x 3,000 GiB). If you initiate a time-based copy operation, but the requested completion duration is not met due to you exceeding a quota, you are billed based on the actual completion duration instead of the requested completion duration. For example, if you request a completion duration of 1 hour, but the operation completes in 2 hours, you are billed based on the rate for the 2 hour completion duration. If Amazon EBS is not able to achieve the requested completion duration or if a request is canceled due to service-side issues, you are not billed the additional charges for the time-based snapshot copy operation. If you delete the snapshot copy while the time-based snapshot copy operation is still in progress, you are billed for the data copied up to that point at the rate corresponding to the specified completion duration. ## Encryption and snapshot copying **Note** Amazon S3 server-side encryption (256-bit AES) protects a snapshot's data in transit during a copy operation. You can create an encrypted snapshot copy of a source snapshot that is unencrypted. And you can encrypt a snapshot copy with a KMS key that is different from the source snapshot. However, changing the encryption status of a snapshot copy during a copy operation could result in a full (not incremental) copy, which might incur greater data transfer and storage charges. **Tip** When using an encrypted snapshot that is shared with you, we recommend that you re-encrypt the snapshot by copying it and using a KMS key that you own. This protects you if the original KMS key is compromised, or if the owner revokes your access, which could cause you to lose access to the snapshot and any encrypted volumes that you created from it. **Permissions for copying encrypted snapshots** To copy an encrypted snapshot, your user must have the following permissions to use Amazon EBS encryption. + + `kms:DescribeKey` + `kms:CreateGrant` + `kms:GenerateDataKey` + `kms:GenerateDataKeyWithoutPlaintext` + `kms:ReEncrypt` + `kms:Decrypt` + To copy an encrypted snapshot that is shared from another AWS account, you must have permissions to use customer managed key that was used to encrypt that snapshot. For more information, see [Share the KMS key used to encrypt a shared Amazon EBS snapshot](share-kms-key.md). **Encryption outcomes for snapshot copies** The following table describes the encryption outcomes when copying snapshots that you own and snapshots that are shared with you. | Encryption by default for destination Region | Source snapshot | Snapshot copy encryption outcome | Note | | --- | --- | --- | --- | | Disabled | Unencrypted | Optional encryption | If you encrypt the copy, you can specify the KMS key to use. If you encrypt the copy but do not specify a KMS key, the key specified for encryption by default is used. | | Disabled | Encrypted | Automatically encrypted | You can specify the KMS key to use. If you do not specify a KMS key, the AWS managed key (aws/ebs) is used. | | Enabled | Unencrypted | Automatically encrypted | You can specify the KMS key to use. If you do not specify a KMS key, the key specified for encryption by default is used. | | Enabled | Encrypted | Automatically encrypted | You can specify the KMS key to use. If you do not specify a KMS key, the key specified for encryption by default is used. | ## Copy a snapshot You can copy snapshots from one Region to another. You can copy an unencrypted snapshot to an encrypted snapshot. However, if you attempt to copy an encrypted snapshot without having permissions to use the encryption key, the operation fails silently and the snapshot copy receives the "Given key ID is not accessible" status message. ------ #### [ Console ] **To copy a snapshot** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, choose **Snapshots**. 1. Select the snapshot to copy, and then choose **Actions**, **Copy snapshot**. 1. For **Description**, enter a brief description for the snapshot copy. By default, the description includes information about the source snapshot so that you can identify a copy from the original. 1. Specify the destination for the snapshot copy. + To copy the snapshot to the same Region or to a different Region, select **AWS Region** and then select the destination Region. + To copy the snapshot to a Local Zone, select **AWS Local Zone** and then select the destination Local Zone. + (*Outpost customers only*) To copy the snapshot to an Outpost, select **AWS Outpost** and then enter the ARN of the destination Outpost. 1. If you need the snapshot copy to be completed within a specific timeframe, select **Enable time-based copy**. For **Completion duration**, enter the required completion duration, in 15-minute increments. For more information, [Time-based copies for Amazon EBS snapshots and EBS-backed AMIs](time-based-copies.md). If you do not need the snapshot copy to be completed in a specific timeframe, do not enable time-based copy. In this case, the snapshot copy is completed on a best-effort basis. 1. (*Outpost customers only*) To create the snapshot copy on an Outpost in the selected Region, for **Snapshot destination** choose **AWS Outpost**, and then for **Destination Outpost ARN**, enter the ARN of the Outpost to which to copy the snapshot. The **Snapshot destination** field appears only if you have and Outpost in the selected Region. 1. Specify the encryption status for the snapshot copy. If the source snapshot is encrypted, or if your account is enabled for [encryption by default](encryption-by-default.md), the snapshot copy is automatically encrypted. If the source snapshot is unencrypted and your account is not enabled for encryption by default, encryption is optional. 1. Choose **Copy snapshot**. ------ #### [ AWS CLI ] **To copy a snapshot to another Region** Use the [copy-snapshot](https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html) command. The following example copies the specified snapshot from the source Region to the current Region, which is specified by the `--region` option. ``` aws ec2 copy-snapshot \ --source-snapshot-id snap-0abcdef1234567890 \ --source-region us-east-1 \ --region us-west-2 ``` **To copy an unencrypted snapshot to an encrypted snapshot** Use the [copy-snapshot](https://docs.aws.amazon.com/cli/latest/reference/ec2/copy-snapshot.html) command. The following example copies the specified unencrypted snapshot from the source Region to the current Region, encrypting the new snapshot using the specified KMS key. ``` aws ec2 copy-snapshot \ --source-snapshot-id snap-0abcdef1234567890 \ --source-region us-east-1 \ --encrypted \ --kms-key-id alias/my-kms-key ``` ------ #### [ PowerShell ] **To copy a snapshot to another Region** Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Snapshot.html) cmdlet. The following example copies the specified snapshot from the source Region to the current Region, which is specified by the `--region` option. ``` Copy-EC2Snapshot ` -SourceSnapshotId snap-0abcdef1234567890 ` -SourceRegion us-east-1 ` -Region us-west-2 ``` **To copy an unencrypted snapshot to an encrypted snapshot** Use the [Copy-EC2Snapshot](https://docs.aws.amazon.com/powershell/latest/reference/items/Copy-EC2Snapshot.html) cmdlet. The following example copies the specified unencrypted snapshot from the source Region to the current Region, encrypting the new snapshot using the specified KMS key. ``` Copy-EC2Snapshot ` -SourceSnapshotId snap-0abcdef1234567890 ` -SourceRegion us-east-1 ` -Encrypted $true ` -KmsKeyId alias/my-kms-key ``` ------