Sharing an AWS EC2 image encrypted with an AWS managed key across the accounts

Question

I like to share the image across accounts but the image is encrypted with an AWS managed key and I was wondering how I can transfer this image to another account.

I gather an image encrypted with custome keys is transferrable, and is it the same with the image with an AWS key?

Answer 1

KMS
With KMS you have AWS Managed Key and Customer Managed Key (CMK).
To allow another account to use your key it needs to be a CMK, because you need to allow it on your key police.
https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html

You can't change police on AWS Managed Key. Which means you can't allow other accounts to use an AWS Managed Key.

So you can't share your encrypted AMI with another account when it is using AWS Managed Key.

AMI

An AMI can't be transferred, but you share it with another account. When it is encrypted you need to share the key as well. See documentation below.
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/sharingamis-explicit.html

As your current AMI is encrypted with AWS Managed Key, what you can do is create a new AMI without encryption or encrypted with CMK and share it. See documentation below.
https://aws.amazon.com/premiumsupport/knowledge-center/account-transfer-ec2-instance/