back up data within the same region or across regions and change the snapshot encryption status by copying a snapshot - Elastic Compute Service

You can copy snapshots within the same region or across regions to flexibly and reliably back up data. You can use the Copy and Encrypt feature to encrypt snapshot copies when you copy snapshots. This improves data security. This topic describes how to copy a snapshot within the same region or across regions.

Prerequisites

A snapshot is created. For more information, see Create a snapshot for a disk.
Key Management Service (KMS) is activated before you copy a snapshot to create an encrypted snapshot copy. For more information, see Activate KMS.

Use scenarios

Snapshot replication is applicable to the following scenarios:

DevOps scenarios
You can copy snapshots to start business in new regions or migrate business systems to new regions. This helps you reduce O&M costs and improve data availability.
Inter-region or cross-region backup scenarios
Snapshot replication helps meet the requirements for compliance audit and improvement of business reliability. In the event of a disaster, you can restore your business systems by using snapshot copies in another region. This reduces the recovery time objective (RTO) and recovery point objective (RPO).

The following table describes the differences between copy scenarios and copy and encryption scenarios.

Scenario	Usage	Security	Procedure
Copy scenarios	You can copy unencrypted snapshots across regions to back up data or create disks based on the unencrypted snapshot copies in the destination regions.	You can directly access unencrypted snapshots.	Copy scenarios
Copy and encryption scenarios	You can copy unencrypted snapshots within the same region to create encrypted snapshot copies. The encrypted snapshot copies that reside in the same region as the source snapshots can use different encryption keys. You can copy unencrypted snapshots across regions to create encrypted snapshot copies. You can use the encrypted snapshot copies to back up data or create disks in the destination regions. The encrypted snapshot copies that reside in different regions from the source snapshots can use different encryption keys.	You can access encrypted snapshots only with encryption keys. This can protect sensitive snapshot data from unauthorized access. Encrypted snapshots provide a higher level of security. This ensures better protection for data privacy and security.	Copy and encryption scenarios

Precautions

When you copy snapshots, take note of the items described in the following table.

Item	Description
Replication fee	After a snapshot is copied to a destination region, a snapshot copy is generated in the region. You are charged a data transfer fee for the snapshot replication. In addition, you are charged for the snapshot copy based on the snapshot size and storage duration. For more information, see Billing of snapshots. Note The first time a snapshot of a disk is copied, the snapshot copy is a full copy that contains all data stored on the disk. All subsequent snapshot copies of the disk in the same region are incremental copies, and each incremental copy contains only the data that has changed since the previous copy. Snapshots are billed based on the snapshot size. Incremental copies can significantly reduce the sizes of snapshots to be copied. You are charged for encryption keys that are used to encrypt snapshots. For more information, see Billing of KMS.
Replication efficiency	You can copy a snapshot faster than an image and use snapshot replication to bypass capacity constraints. If you want to copy a large image, we recommend that you copy its associated snapshots to the destination region and create an image based on the snapshot copies in the region. For information about how to copy a snapshot, see the procedure described in this topic. For information about how to create an image, see Create a custom image from a snapshot.
Others	The tags that are added to snapshots cannot be copied together with the snapshots.
New snapshot (snapshot copy) limit	The ID of a snapshot copy is different from that of its source snapshot. The snapshot copy cannot be used to restore disks created from the source snapshot.

Procedure

Log on to the ECS console.
In the left-side navigation pane, choose Storage & Snapshots > Snapshots.
In the top navigation bar, select the region and resource group to which the resource belongs.
Find the snapshot that you want to copy and click Copy Snapshot in the Actions column.

In the Copy Snapshot dialog box, configure parameters based on your copy scenarios.

Copy scenarios

Parameter	Required	Description
Copy Type	Yes	Select Copy.
Destination Region	Yes	Select a destination region. The region must be different from the region where the source snapshot resides.
Snapshot Name	Yes	Enter a name for the new snapshot.
Description	No	Enter a description for the new snapshot. To facilitate subsequent management, we recommend that you enter information such as the purpose and environment of the new snapshot.
Tag	No	Add tags to the new snapshot. The tags help facilitate subsequent management of the new snapshot. Note When you copy a snapshot, you cannot copy the tags of the snapshot to the new snapshot.

Copy and encryption scenarios

Parameter	Required	Description
Copy Type	Yes	Select Copy and Encrypt. Note Snapshots that are created for encrypted disks are also encrypted. If the snapshot that you want to copy is an encrypted snapshot, select Copy and Encrypt.
Destination Region	Yes	Select a destination region. The selected region can be the region of the source snapshot or a different region.
Encryption Key	Yes	Select a key to use to encrypt the new snapshot. Select Default Service CMK or a custom key from the drop-down list. Default Service CMK: the default key generated by KMS. A custom key: a key that you created in KMS. For more information, see Create a CMK. Note The first time you select an encryption key, click Authorize and follow the on-screen instructions to attach the `AliyunECSDiskEncryptDefaultRole` role to grant Elastic Compute Service (ECS) access to your KMS resources.
Snapshot Name	Yes	Enter a name for the new snapshot.
Description	No	Enter a description for the new snapshot. To facilitate subsequent management, we recommend that you enter information such as the purpose and environment of the new snapshot.
Tag	No	Add tags to the new snapshot. The tags help facilitate subsequent management of the new snapshot. Note When you copy a snapshot, you cannot copy the tags of the snapshot to the new snapshot.

Confirm and select the message related to snapshot replication fees, and then click Confirm to copy the source snapshot.
Note
When the new snapshot is being created in the destination region, Processing is displayed in the Progress column. You can click Delete Snapshot in the Actions column to cancel the snapshot copying task.
1. In the upper-left corner of the top navigation bar, select the destination region. Then, on the Snapshots page, find the new snapshot.
2. In the Actions column, choose > Delete Snapshot.
(Optional) Switch to the destination region and view the information of the new snapshot.
- When the snapshot copying task is completed, Successful is displayed in the Progress column corresponding to the new snapshot, as shown in the red box marked ① in the preceding figure.
- Move the pointer over Snapshot Copy in the Creation Method column corresponding to the new snapshot, as shown in the red box marked ② in the preceding figure. The ID of the source snapshot is displayed.
- Check the Encrypted/Unencrypted column to determine whether the new snapshot is encrypted, as shown in the red box marked ③ in the preceding figure.