Elastic Compute Service:Share a snapshot

Step 1: Create a Resource Access Management (RAM) role and grant permissions to the RAM role

Before you can share an encrypted snapshot, log on to the RAM console to create a role named AliyunECSShareEncryptSnapshotDefaultRole and grant permissions to the role. Then, you can use the role to share the encrypted snapshot with other Alibaba Cloud accounts.

1. Use Account A to log on to the RAM console.

2. Before you share an encrypted snapshot, create a RAM role whose name is AliyunECSShareEncryptSnapshotDefaultRole.

   1. In the left-side navigation pane, choose Identities > Roles.

   2. Click Create Role.

   3. In the Select Role Type step, select Alibaba Cloud Account and click Next.

   4. In the Configure Role step, enter AliyunECSShareEncryptSnapshotDefaultRole in the RAM Role Name field, set Select Trusted Alibaba Cloud Account to Current Alibaba Cloud Account, and then click OK.

3. Grant permissions to the AliyunECSShareEncryptSnapshotDefaultRole role.

   1. In the Finish step, click Add Permissions to RAM Role.

   2. In the Select Policy section of the Grant Permission panel, click Create Policy.

      

   3. On the Create Policy page, click the JSON tab.

   4. Edit the following policy code to grant the permissions to share only the specified encryption key for snapshots in a specific region in a specific Alibaba Cloud account:

      {
        "Version": "1",
        "Statement": [
          {
            "Action": "kms:List*",
            "Resource": "acs:kms:cn-hangzhou:<Alibaba Cloud UID of the KMS key>:key",
            "Effect": "Allow"
          },
          {
            "Action": [
              "kms:DescribeKey",
              "kms:TagResource",
              "kms:UntagResource",
              "kms:Encrypt",
              "kms:Decrypt",
              "kms:GenerateDataKey"
            ],
            "Resource": "acs:kms:cn-hangzhou:<Alibaba Cloud UID of the KMS key>:key/<KMS key associated with the snapshot>",
            "Effect": "Allow"
          }
        ]
      }

      Replace cn-hangzhou, <Alibaba Cloud UID of the KMS key>, and <KMS key associated with the snapshot> with the region ID of the snapshot that you want to share, the Alibaba Cloud account ID of the snapshot, and the ID of the KMS key that is used to encrypt the snapshot.

   5. Configure other parameters based on the on-screen instructions.

4. Add the AliyunECSShareEncryptSnapshotDefaultRole role to Account B.

   1. Go back to the Roles page. In the search box to the right of Create Role, enter AliyunECSShareEncryptSnapshotDefaultRole. Then, click the role name to go to the role details page.

      

   2. On the AliyunECSShareEncryptSnapshotDefaultRole role details page, click the Trust Policy tab.

   3. Click Edit Trust Policy and replace the default trust policy in the Edit Trust Policy panel.

      • If you want to share an encrypted snapshot with an Alibaba Cloud account, replace the default trust policy with the following policy. In the replacement policy, replace <UID> with the ID of the Alibaba Cloud account with which to share the snapshot.

        {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "<UID>@ecs.aliyuncs.com"
                ]
              }
            }
          ],
          "Version": "1"
        }

      • If you want to share an encrypted snapshot with multiple Alibaba Cloud accounts, replace the default trust policy with the following policy. In the replacement policy, replace <UID-X> with the ID of each Alibaba Cloud account with which to share the snapshot.

        {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "<UID-1>@ecs.aliyuncs.com",
                  "<UID-2>@ecs.aliyuncs.com",
                  "<UID-3>@ecs.aliyuncs.com"
                ]
              }
            }
          ],
          "Version": "1"
        }

   4. Click OK.

Step 2: Share the encrypted snapshot

1. Use Account A to log on to the ECS console.

2. In the left-side navigation pane, choose Storage & Snapshots > Snapshots.

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. Find the encrypted snapshot that you want to share and choose > Share Snapshot in the Actions column.

5. In the Add to Resource Share dialog box, configure the parameters.

   

   1. Select the resource share that you created in the Shared By Me (by choosing Resource Management > Resource Sharing > Resources I Share from the left-side navigation pane on the Resource Management console).

      Note

      The Resources Sharing feature of Resource Management allows you to share snapshots with other Alibaba Cloud accounts. You can create resource shares to share your resources. A resource share consists of a resource owner, principals, and shared resources. Principals are the Alibaba Cloud accounts that are invited to use the resources of the resource owner. For more information about resource shares, see Resource Sharing overview.

   2. In the Principals section, click Edit to add a principal.

      1. By default, the Principal Scope parameter is set to All Accounts. For more information, see the Methods used to share resources section in the "Resource Sharing overview" topic.

      2. Set Principal ID to the ID of Account B and click Add to share the snapshot with Account B.

6. Click OK.