Share a snapshot with other Alibaba Cloud accounts - Elastic Compute Service

You can share a snapshot with other Alibaba Cloud accounts or within your enterprise by using a resource directory. Principals can then use the shared snapshot to quickly create cloud disks, enabling cross-account collaboration or resource sharing within your enterprise. This topic describes how to share and unshare a snapshot, and related considerations.

Use cases

Snapshot sharing is ideal for the following scenarios

Cross-account data sharing
You can share data between accounts or departments within an enterprise by sharing snapshots, which principals can use to quickly create cloud disks.
Batch deployment
By using a shared snapshot, you can deploy the same application on multiple ECS Instances across accounts. This ensures that each instance starts with the same initial state. You can then quickly set up identical business systems in separate accounts, which reduces repetitive configuration and maintains consistency.

Usage notes

Before sharing a snapshot, take note of the following limitations:

Category	Description
Billing	The sharing process itself is free of charge. Sharees are charged for resources they create, such as creating cloud disks or copying snapshots across regions from a shared snapshot. If a shared snapshot expires but is not unshared, it is not automatically released and continues to incur charges.
Quotas	You can share a snapshot with up to 64 Alibaba Cloud accounts. Each Alibaba Cloud account can share up to 1,024 snapshots.
Account restrictions	Sharing snapshots between accounts on the China site and accounts on the international site is not supported.
Other limitations	Sharers Cannot directly delete shared snapshots. Before you delete a shared snapshot, you must unshare it. Cannot share the snapshots that are created from imported custom images. Cannot share the snapshots that are encrypted using service keys. Note IIf you need to share an encrypted snapshot that uses a Service Key, you can use the copy the snapshot feature to change the Service Key to a Customer Master Key (CMK) before sharing. For more information about ECS encryption keys, see Disk encryption. Sharees Cannot use shared snapshots to create custom images. Cannot use shared snapshots to roll back cloud disks, because the shared snapshot ID differs from the source snapshot ID. Cannot directly delete shared snapshots. Before you delete a shared snapshot, you must unshare it. Cannot archive shared snapshots. Cannot re-share shared snapshots. Note To perform operations on a shared snapshot, you can: Use the shared snapshot to create a new cloud disk, attach it to an ECS instance, create a new snapshot of the disk, and then share the new snapshot. Copy the shared snapshot, and then share the new snapshot created from the copy. Cannot extend the retention period of a shared snapshot. Note If the original snapshot is set for permanent retention, the shared snapshot has a retention period of 1,096 days. If the original snapshot has a custom retention period, the shared snapshot follows the original retention period.

Before you begin

Ensure that the snapshot does not contain any sensitive data or files before sharing it.
Complete the required preparations for your sharing scenario.
- To share a snapshot with another Alibaba Cloud account, obtain the Alibaba Cloud account ID.
  To obtain the ID, move the pointer over your profile picture in the upper-right corner of the console. In the user information box that appears, if the account is identified as a Main Account, the displayed account ID is the Alibaba Cloud account ID.
- To share a snapshot within your enterprise by using a resource directory, your Alibaba Cloud account must meet one of the following conditions:
  - Your account has not enabled a resource directory but is a member of one.
  - You pass enterprise verification, enable the resource directory feature, and then enable resource sharing.
To share an encrypted snapshot that uses a Customer Master Key (CMK), first create the AliyunECSShareEncryptSnapshotDefaultRole Resource Access Management (RAM) role, and grant the required permissions to the role. For more information, see Share encrypted resources across accounts.

Share a snapshot

Console

Step 1: The sharer shares a snapshot

Go to the snapshot sharing page.
1. Go to ECS console - Snapshots.
2. In the top navigation bar, select the region and resource group of the resource that you want to manage.
3. On the Disk Snapshots tab, find the snapshot you want to share and choose > Share Snapshot in the Actions column.
In the Add to Resource Share dialog box, configure the parameters.
1. Set Method to Existing Resource Share or New Resource Share.
  Note
  Snapshot sharing uses resources sharing from Resource Management. You can add shared resources and principals to a Resource Share to share your resources with other members.
2. (Conditionally required) Set the Principal Scope. This parameter is required only when you select New Resource Share for Method.
  - All Accounts: You can share the snapshot with any sharee.
  - Objects Within Resource Directory: You can share the snapshot only within the resource directory. The management account or members of the resource directory can share the snapshot only with the resource directory itself, its folders, and its members.
3. Click Add Principals, specify parameters of the sharees and click OK.
  - Scenario 1: Share the snapshot with other Alibaba Cloud account.
    For Principal Type, select Cloud Account and Principal ID to the Alibaba Cloud account ID of the sharee.
    Note
    If you set Principal Scope to Objects Within Resource Directory, you can only select Alibaba Cloud accounts within the resource directory.
    To share the snapshot with multiple Alibaba Cloud accounts, add each account separately.
  - Scenario 2: Share the snapshot within an enterprise by using a resource directory.
    - If you (the sharer) do not enable the resource directory feature and belong to a resource directory as members, in the Add Principals dialog box, set Principal Type to Resource Directory or Folder (Organization Unit). For the later, you also need to enter the folder ID.
    - If the resource directory feature is enabled for your Alibaba Cloud account (sharer), in the Add Principals dialog box, select the desired resource directory or folder from the list, or add them manually.
    Note
    You can also share snapshots from the Resource Management console. For more information, see Manage shared resources as a resource owner.
    If you share a snapshot with an entire resource directory or folder, all accounts within it can access the shared snapshot. When a new account joins the resource directory or folder, the snapshot is automatically shared with the new account. When an account is removed, the share is automatically revoked for that account.
4. Click OK.

Step 2: A sharee accepts and uses the shared snapshot

To complete the sharing process, the principal must accept the invitation.

(Conditionally required) The sharee accepts the shared snapshot. This step is required the first time a new or existing resource share is used.
1. Log on to the Resource Management console.
2. In the left-side navigation pane, choose Resource Sharing > Resources Shared To Me.
3. In the upper-left corner of the top navigation bar, select the region where the shared snapshot is located.
4. On the Shared To Me page, find the resource share and click Accept in the Status column.
5. In the Accept Resource Sharing Invitation dialog box, click Accept.
  After accepting, you can use the shared snapshot. Any new resources added to this resource share in the future will be accepted by default.
View the shared snapshot.
1. Go to ECS console - Snapshots.
2. In the upper-left corner of the top navigation bar, select the region where the shared snapshot is located.
3. Find the shared snapshot in the snapshot list.
  - Hover over the icon to view a tag in the format acs:ecs:sharedFrom:<UID of the account that shares the snapshot>:<Region in which the source snapshot resides>:<ID of the source snapshot>.
  - The Creation Method is marked as Shared Snapshot.
  - Hover over the icon to view information such as the sharer's account UID and the source snapshot ID.
    You can also choose > View Shared Snapshot in the Actions column to view information about the shared snapshot in the Resource Management console.
(Optional)Create a data disk from a shared snapshot or copy a shared snapshot.
Note
- If you share an encrypted snapshot, you must change the encryption key when you use the shared snapshot to create a new cloud disk or to copy the snapshot.
- When you create a Cloud Disk from a shared encrypted snapshot, you can only create ESSD, ESSD AutoPL, and ESSD Entry disks. If you need to create other types of Cloud Disks, you can first copy the snapshot and then create a new Cloud Disk from the copy.

API

This section provides an open-source sample project in Java that demonstrates how to use an SDK to share a snapshot across accounts and use the shared snapshot to create a cloud disk.

Click snapshot sharing sample project to download the snapshot sharing sample project.
The project includes three code samples:
- CreateResourceShare: The sharer creates a resource share and initiates snapshot sharing.
- ReceiveResourceShare: The sharee accepts the snapshot sharing invitation.
- UseResourceShare: The sharee uses the shared snapshot to create a cloud disk.
Configure the sample project.
1. Configure SDK dependencies in the pom.xml file. For more information, see Java SDK call examples.
```

<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>resourcesharing20200110</artifactId>
  <version>${lastVersion}</version>
</dependency>

<dependency>
  <groupId>com.aliyun</groupId>
  <artifactId>alibabacloud-ecs20140526</artifactId>
  <version>${lastVersion}</version>
</dependency>
```
  Note
  SDK packages are frequently updated. We recommend that you obtain the latest dependency version from the GitHub links provided in SDK overview.
2. Add the ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET environment variables in your local environment and set them to your prepared AccessKey ID and AccessKey secret.
3. Replace other variable parameters in the project as needed, such as the shared snapshot ID, the principal's account UID, and the type of Cloud Disk to be created.
Compile and run each part of the Java code as needed.
Verify the results in the product console based on the output.
For example, the sharer can log on to the Resource Management console to view the created resource share. The sharee can log on to the ECS console to view the shared snapshot and the disk created from it.

Unshare a snapshot

If the shared snapshot is no longer needed, the sharer can unshare it.

Considerations

When a snapshot is unshared, the sharee is affected in the following ways:

The sharees can no longer query the snapshot by using the ECS console or ECS API.
The sharees cannot perform the re-initialize disk operation on cloud disks that were created from the shared snapshot.
Snapshots that were copied from the shared snapshot are not affected.

Procedure

The sharer goes to the snapshot sharing page.
1. Go to ECS console - Snapshots.
2. In the top navigation bar, select the region and resource group of the resource that you want to manage.
3. On the Disk Snapshots tab, find the snapshot you want to unshare and choose > Share Snapshot in the Actions column.
Unshare a snapshot.
1. In the Principals section, click Edit.
2. In the Added Principals section, click Remove in the Actions column for the sharee you want to remove.
3. Click OK to stop sharing the snapshot.