SEATTLE — In a major expansion of its cloud storage capabilities, Amazon Web Services (AWS) has announced the rollout of cross-account copy support for Amazon Elastic Block Store (Amazon EBS) Volume Clones. This new feature allows cloud administrators and development teams to seamlessly duplicate production-grade EBS storage across distinct AWS accounts. By bridging organizational boundaries, the release aims to streamline how modern enterprises manage test data, foster compliance-driven isolation, and accelerate software delivery lifecycles without compromising on robust security standards.
The announcement builds on the foundation laid last year when AWS originally debuted Volume Clones. That initial capability introduced instant, point-in-time storage duplication within a single Availability Zone, transforming how engineers spun up storage environments. By extending this functionality across accounts—and integrating optional re-encryption via AWS Key Management Service (AWS KMS)—AWS is addressing one of the most persistent bottlenecks in enterprise DevOps: safely moving real-world data into isolated sandboxes for staging, testing, and advanced experimentation.
Main Facts
The newly expanded Amazon EBS Volume Clones capability introduces several core technical mechanisms and operational benefits designed to modernize cloud management:
- Cross-Account Sharing via AWS RAM: Volume owners can securely grant permissions to external AWS accounts using AWS Resource Access Manager (AWS RAM). This integration allows organizations to manage cross-account access granularly, whether operating within a unified AWS Organization or collaborating across independent accounts.
- Target-Side Re-Encryption: When a volume is copied into a secondary account, administrators have the option to re-encrypt the data using an AWS KMS key managed natively within the target account. This ensures that organizational boundaries and cryptographic controls remain strictly enforced.
- Production Isolation: Development and quality assurance teams can continuously refresh their staging environments with the most up-to-date production data. Critically, this is achieved while keeping the production environment completely isolated, protecting sensitive assets from accidental exposure during experimental workflows.
- Programmatic and AI-Driven Integration: Teams can automate these cross-account workflows via standard AWS APIs. Furthermore, developers can leverage tools like the AWS MCP Server and associated plugins to interact with documentation, APIs, and provisioning pipelines directly within their preferred AI coding environments.
- Global Availability: The feature is live today across all AWS Regions that currently support standard Amazon EBS Volume Clones, providing broad accessibility for global enterprises.
Chronology: The Evolution of EBS Storage Management
To fully understand the significance of today’s announcement, it is helpful to trace how AWS has systematically evolved its EBS snapshot and cloning architectures over recent years:
The Traditional Era: Snapshots and Point-In-Time Restoration
For over a decade, Amazon EBS relied primarily on snapshots stored in Amazon Simple Storage Service (Amazon S3) to back up block storage volumes. While reliable, creating a new volume from a snapshot historically required a data-loading phase, where blocks were lazily pulled from S3 upon access. This introduced performance latency when rapidly spinning up identical clones for high-throughput testing environments or sudden disaster recovery scenarios.
The 2024 Milestone: Introduction of Volume Clones
Recognizing the demand for instantaneous storage provisioning, AWS introduced Amazon EBS Volume Clones. This capability fundamentally changed the underlying architecture by enabling immediate, point-in-time block-level duplicates within the same Availability Zone. Rather than copying blocks across storage tiers upfront, Volume Clones utilized a redirect-on-write architecture, allowing engineers to create full-performance copies instantaneously, regardless of the volume size. However, these initial clones were strictly bound to the local account and Availability Zone where they were initiated.
The 2025 Expansion: Cross-Account Capabilities
With the latest enhancement, AWS has removed the account boundary constraint. By integrating Volume Clones with AWS Resource Access Manager (AWS RAM) and AWS KMS, cloud architects are no longer restricted to local-account testing paradigms. Organizations can now architect sophisticated, multi-account enterprise pipelines where production snapshots can flow safely into segregated sandbox accounts with a few clicks or API calls.
Supporting Data and Architectural Mechanics
The technical execution of cross-account EBS cloning relies on a tightly orchestrated sequence of permissions and console interactions designed to balance agility with strict access governance.
Step-by-Step Operational Workflow
- Initiation of Sharing: Within the Amazon EC2 console, the owner of the source EBS volume navigates to the volume details and selects the Share volume option.
- Resource Share Configuration: The administrator either adds the volume to an existing resource share or establishes a new one via the AWS RAM console, explicitly defining which external AWS accounts or organizational units are permitted access.
- Acceptance in the Target Account: Security best practices dictate that passive sharing is insufficient. The designated target account must explicitly log into the AWS RAM console to accept the incoming resource share before any data visibility is granted.
- Execution of the Copy: Once accepted, the shared volume populates within the EBS console of the target account. The target administrator selects Copy volume, at which point they can designate a custom AWS KMS key for re-encryption, ensuring compliance with internal data governance frameworks.
Developer Tooling and Automation
Modern infrastructure management demands robust API support. AWS has ensured that cross-account volume cloning is fully automatable through standard infrastructure-as-code (IaC) tools and software development kits (SDKs). Additionally, AWS has leaned into modern developer workflows by enabling AI-assisted tooling. Developers utilizing the AWS MCP Server and compatible plugins can query APIs, search documentation, and construct scripts to manage cross-account shares seamlessly from their integrated development environments (IDEs).
Official Perspectives and Industry Implications
While specific executive soundbites from the AWS leadership team emphasize the continuous drive toward developer velocity and security-by-design, industry analysts have been quick to point out the broader architectural implications of this release.
Bridging Security and Agility
In many enterprise organizations, a perpetual tug-of-war exists between security teams—who mandate strict account segregation and least-privilege access—and development teams, who require fresh, realistic production data to accurately test patches, new features, and machine learning models.
By tying cross-account cloning directly to AWS RAM and AWS KMS, AWS has provided a native bridge that satisfies both factions. Security teams retain absolute control over who can access the resource and how it is encrypted upon arrival in the target account. Meanwhile, developers gain immediate access to high-fidelity datasets without needing cumbersome manual interventions, cross-account credential sharing, or risky credential-export practices.
Impact on CI/CD Pipelines and Enterprise Testing
Continuous Integration and Continuous Deployment (CI/CD) pipelines rely heavily on staging environments that mirror production as closely as possible. Historically, refreshing these staging environments meant managing complex snapshot copy jobs, waiting for data hydration, and manually re-applying encryption policies in secondary accounts.
The integration of instant Volume Clones with cross-account copy significantly compresses this feedback loop. Test suites that previously took hours to initialize with fresh data can now be provisioned in seconds. This speed enhancement enables more frequent automated testing cycles, earlier identification of database migration bugs, and ultimately a more resilient software release cadence.
Conclusion and Next Steps
The introduction of cross-account copy for Amazon EBS Volume Clones represents a major step forward in multi-account cloud architecture. By combining the speed of instant block-level cloning with the governance of AWS RAM and the cryptographic security of AWS KMS, AWS has solved a classic enterprise dilemma: how to share data quickly without compromising isolation or safety.
Cloud administrators, DevOps engineers, and security architects can begin experimenting with the new feature immediately through the Amazon EC2 console across all supported AWS Regions. Organizations looking to dive deeper into technical specifications, API parameters, and best practices are encouraged to consult the updated Amazon EBS User Guide and submit feedback through the AWS re:Post for Amazon EBS community forums.
