Elastic Compute Service:Share a snapshot with other Alibaba Cloud accounts

Step 1: Create a Resource Access Management (RAM) role and grant permissions to the RAM role

Before you can share an encrypted snapshot, log on to the RAM console to create a role named AliyunECSShareEncryptSnapshotDefaultRole and attach a policy that contains the required permissions to the role. Then, you can use the role to share the encrypted snapshot with other Alibaba Cloud accounts.

1. Log on to the RAM console as a sharer.

2. On the Policies page, click Create Policy. On the Create Policy page, click the JSON tab to create a custom policy. For more information, see the Create a custom policy on the JSON tab section of the "Create custom policies" topic.

   The following code provides an example on the content of the custom policy. The policy grants the permissions only on the CMK of the specified encrypted snapshot that is shared.

   {
     "Version": "1",
     "Statement": [
       {
         "Action": "kms:List*",
         "Resource": "acs:kms:<ID of the region to which the CMK belongs>:<ID of the Alibaba Cloud account to which the CMK belongs>:key",
         "Effect": "Allow"
       },
       {
         "Action": [
           "kms:DescribeKey",
           "kms:TagResource",
           "kms:UntagResource",
           "kms:Encrypt",
           "kms:Decrypt",
           "kms:GenerateDataKey"
         ],
         "Resource": "acs:kms:<ID of the region to which the CMK belongs>:<ID of the Alibaba Cloud account to which the CMK belongs>:key/<ID of the CMK associated with the snapshot>",
         "Effect": "Allow"
       }
     ]
   }

   Note

   You must replace the <ID of the region to which the CMK belongs>, <ID of the Alibaba Cloud account to which the CMK belongs>, and <ID of the CMK associated with the snapshot> with the ID of the region to which the CMK belongs, ID of the Alibaba Cloud account ID to which the CMK belongs, and the CMK ID.

3. On the Roles page, create a RAM role named AliyunECSShareEncryptSnapshotDefaultRole for a trusted Alibaba Cloud account.

   For more information, see Create a RAM role for a trusted Alibaba Cloud account.

4. On the Roles page, click the AliyunECSShareEncryptSnapshotDefaultRole role that you created to go to the role details page.

   • On the Permissions tab, click Grant Permission and attach the custom policy that you created in Step 2 to the RAM role. For more information, see the Method 1: Grant permissions to a RAM role by clicking Grant Permission on the Roles page section of the "Grant permissions to a RAM role" topic.

   • On the Trust Policy tab, click Edit Trust Policy and specify the sharees with which to shared the encrypted snapshot. The following code provides an example on the content of the trust policy. For more information, see Edit the trust policy of a RAM role.

     {
       "Statement": [
         {
           "Action": "sts:AssumeRole",
           "Effect": "Allow",
           "Principal": {
             "Service": [
               "<UID>@ecs.aliyuncs.com"
             ]
           }
         }
       ],
       "Version": "1"
     }

     Note

     In the trust policy, replace <UID> with the ID of the Alibaba Cloud account with which to share the snapshot. To share a snapshot with multiple Alibaba Cloud accounts, you must add the IDs of the Alibaba Cloud accounts with which to share the snapshot.

Step 2: Share the encrypted snapshot

1. Log on to the ECS console as a sharer.

2. In the left-side navigation pane, choose Storage & Snapshots > Snapshots.

3. In the top navigation bar, select the region and resource group to which the resource belongs.

4. Find the encrypted snapshot that you want to share and choose > Share Snapshot in the Actions column.

5. In the Add to Resource Share dialog box, configure the parameters.

   

   1. Select the resource share that you created on the Shared By Me page in the Resource Management console.

      Note

      The Resources Sharing feature of Resource Management allows you to share snapshots with other Alibaba Cloud accounts. You can create resource shares to share your resources. A resource share consists of a resource owner, principals, and shared resources. Principals are the Alibaba Cloud accounts that are invited to use the resources of the resource owner. For more information about resource shares, see Resource Sharing overview.

   2. In the Principals section, click Edit to add a principal.

      1. By default, the Principal Scope parameter is set to Objects Within Resource Directory. For more information, see the Methods used to share resources section of the "Resource Sharing overview" topic.

      2. Enter the ID of the Alibaba Cloud account with which to share the snapshot and click Add.

6. Specify the parameters. Then, click OK.