Copy AMI to a separate region from a separate account

Question

I have been trying to migrate an AMI from my AWS account A (ap-southeast-2) to Account B (us-east-1).

In my account I have given launch permissions to my Account A.

However when I run below code,

$result = $this->destination_ec2_client->copyImage(
          array(
               'SourceRegion' => $this->source_region,
               'SourceImageId' => $image_id,
               'Name' => $amis[0]['Name']
          ));

When I run above code by documentation the call should copy the AMI from source region and copy it to destination region.

However, The final output is an error. The Error is shown on the console under failed AMI description.

State Reason: AMI ownership mismatch

Any thoughts? Have I understood the mechanism correctly?

Exile

Answer 1

The AWS CLI has the same limitation of copy-image between accounts. This is how I got around it:

$ aws ec2 run-instances --image-id $SHAREDAMI --instance-type c3.large  --user-data '#!/bin/bash
> poweroff'

Once the above instance halts:

$ aws ec2 create-image --instance-id $IDFROMRUN --name "Image from other accounts AMI"

The resulting AMI can now be copied between your regions. Ex.:

$ aws --region us-west-1 ec2 copy-image --source-region us-east-1 --source-image-id $AMIFROMCREATE --name "Copy of Image from other accounts AMI"

Coloratura

Actually 'copy-image' works fine between account as of Feb'17 without running any instance. – Nichollenicholls

Answer 2

AFAIK, AMI copy doesn't work cross accounts.

You probably want to create an AMI on account B (ap-southeast-2) based on the AMI on account A (ap-southeast-2) first.

Make sure you set the permissions on the AMI on account A to public. Then you can launch an instance on account B and then create and AMI based on that instance on (ap-southeast-2)

Then while on account B you can run your script to copy the AMI from ap-southeast-2 to us-east-1

Hope this helps.

Birdt