You can copy Amazon Machine Images (AMIs) between AWS regions, but it’s not as straightforward as a simple aws ec2 copy-ami command you might expect.
Let’s see it in action. Imagine you’ve built a standardized AMI in us-east-1 and now need it in eu-west-2.
# First, find the AMI ID in the source region
aws ec2 describe-images --region us-east-1 --filters "Name=name,Values=my-base-ami-v1.0" --query 'Images[*].ImageId' --output text
# Output: ami-0123456789abcdef0
# Now, initiate the copy to the destination region
aws ec2 copy-image --region eu-west-2 --source-image-id ami-0123456789abcdef0 --source-region us-east-1 --name "my-base-ami-v1.0-eu-west-2"
# Output:
# {
# "ImageId": "ami-abcdef0123456789"
# }
# Check the status of the copy
aws ec2 describe-images --region eu-west-2 --image-ids ami-abcdef0123456789 --query 'Images[*].[ImageId,State,Progress]'
# Output:
# [
# [
# "ami-abcdef0123456789",
# "pending",
# "0%"
# ]
# ]
This process involves creating a new AMI in the destination region that is a snapshot of the original AMI’s root volume, copied across the AWS network. The copy-image API call initiates this cross-region replication.
The core problem this solves is distributing your pre-configured AMIs to multiple regions without having to rebuild them in each location. This is crucial for disaster recovery, global application deployments, and consistent environments across your AWS footprint. Internally, AWS handles the data transfer and snapshot creation. You don’t directly interact with EC2 instance snapshots during this process; the copy-image API abstracts that away.
The key levers you control are:
source-image-id: The ID of the AMI you want to copy.source-region: The AWS region where the original AMI resides.region: The AWS region where you want to create the new copy.name: A descriptive name for the new AMI in the destination region.description: An optional, more detailed description.encrypted: You can specifytrueto encrypt the new AMI with a KMS key, orfalseto use the default AWS-managed KMS key for EBS encryption in the destination region. If the source AMI is encrypted, you must specify a KMS key in the destination region.
The copy-image operation is asynchronous. The describe-images command is your go-to for checking its progress. It can take a significant amount of time depending on the size of the AMI’s root volume and network latency between regions.
What most people don’t realize is that the AMI copy process is fundamentally a snapshot copy operation. When you initiate copy-image, AWS takes a snapshot of the source AMI’s root volume, copies that snapshot to the destination region, and then registers that copied snapshot as a new AMI in the destination region. This means the underlying data is transferred, not just metadata.
Once the AMI copy is complete, you’ll need to consider how to manage these distributed AMIs, perhaps using AWS Systems Manager Parameter Store to track their IDs across regions.