-: So very quick lecture, but if you wanted
to migrate an EC2 instance from one AZ to another,
well the way you would do it is using an AMI.
So, in this example, we want to migrate our EC2 instance
from us-east-1a to us-east-1b, in which case, first
we take an AMI from our EC2 instance and then restore
that AMI into a new EC2 instance, in a different AZ
which by default will have the same data
and the same file system and the same applications
because the AMI was taken from the original one.
So, that's it super simple to see, but good to know.
And if you want to see this, well, the AMI here
my instance is in eu-central-1c, okay?
And an image was taken from it.
And so what I can do is
that I can launch an image from this AMI module to micro
and then here I'm able to select a specific AZ
so, a specific subnet, and it could be for example
this one to have it in eu-central-1b
and then I would be good to go.
So, let's say for this lecture, I hope you liked it
and I will see you in the next lecture.
Okay, so now let's talk about cross account AMI sharing.
That means that you're sharing your AMI
with another AWS account.
In this case, when you share an AMI
it does not affect the ownership of the AMI,
you still have it, okay?
And you can share an AMI for in two cases.
Number one, if the volume is unencrypted
and that means you can share it with another account
or even share the AMI publicly, or if it's encrypted
it has to be encrypted with your own customer managed key
and we'll see the process for that as well.
If you are sharing the, what I mean is
that if you're sharing the AMI with an encrypted volume
that means that you need to share any key that is attached
to that volume as well
that was used to encrypt and decrypt that volume
otherwise the targeted account cannot use your volume.
So, let's take an example, a simple one.
We have account A
and this is an unencrypted AMI in your source accounts
and you're just going to share it with account B.
And then the account B can launch directly
an EC2 instance from that source AMI, very simple.
Now, if you add KMS encryption
we have the same use case, but this time your AMI
is actually encrypted with your CMK-A, okay?
And what you're going to do is that you're going to share
this AMI with your account B
but also you're going to share the KMS key.
Okay, your CMK.
And you're going to give permissions to the target accounts
to describe the key to decrypt to re-encrypt and so on.
And this will allow the target accounts
to launch your custom AMI,
even though it was encrypted
with a key from your accounts, okay?
Next, you can have the cross account AMI copy.
So, you have sharing and copying.
If you copy an AMI that has been shared with your accounts
you are then the owner of the target AMI in your accounts.
That means that the owner of the source AMI must grant you
the read permissions for the storage that backs the AMI.
So, the EBS snapshots, so it's a bit more involved.
So, account B now has the permission to read
the EBS snapshots behind the AMI.
So, it can run a copy image, API call
which will copy the source AMI into its own accounts.
And in the process, for example
you can encrypt the snapshot if you wanted to
with your own keys.
And as we'll see in the next slide
if the shared AMI is an encrypted snapshot
the owner must share the encrypted key
or keys with you as well.
And you can encrypt the AMI with your own CMK while copying
So, let's have a look if we have KMS encryption
in this example.
So, we are sharing the underlying EBS snapshot
and we still give KMS key permissions
to the target accounts, okay?
And the target accounts can issue
a copy command to, for example, re-encrypt the EBS snapshot
by decrypting it using the CMK-A that was given access to
and re-encrypt it with CMK-B and its own accounts
which will give a custom AMI that will be owned
by the target account B
with its own encryption mechanism, okay?
So, that's it for how AMI copy and sharing works.
So, if you have an AMI, what you can do
as you can see is that
if this AMI was shared with you, you could copy that AMI
and this would let you get your own copy of the AMI,
regardless of the sharing options afterwards.
Or if you take that AMI itself
you can have a look at the permissions in here
and you can edit these permissions.
So, what you would do is action, edit AMI permissions.
And in here you have multiple options.
So, if your AMI was private
it could be encrypted or unencrypted
or if it was unencrypted, you could make it public, okay?
And you have people around the world that can use your AMI
so, be careful with that.
Also, if you, it was private and you want to share it
with specific accounts organizations or OUs
then you would allow here to add account ID's
and you enter the account ID's.
If you wanted to share with individual accounts
or if you wanted to share with an entire organization
or OUs then you would add the Org/ARN or the OU ARN, okay?
And finally, when you do a sharing
you can click here to add the create volume permission
to the associated snapshots
when creating account permissions.
And this would allow the other accounts
to use your AMI at will, okay?
So, that's it for this lecture.
I hope you liked it.
And I will see you in the next lecture.