Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon EBS local snapshots on Outposts

Amazon EBS snapshots are a point-in-time copy of your EBS volumes.

By default, snapshots of EBS volumes on an Outpost are stored in Amazon S3 in the Region of the Outpost. You can also use Amazon EBS local snapshots on Outposts to store snapshots of volumes on an Outpost locally in Amazon S3 on the Outpost itself. This ensures that the snapshot data resides on the Outpost, and on your premises. In addition, you can use Amazon Identity and Access Management (IAM) policies and permissions to set up data residency enforcement policies to ensue that snapshot data does not leave the Outpost. This is especially useful if you reside in a country or region that is not yet served by an Amazon Region and that has data residency requirements.

This topic provides information about working with Amazon EBS local snapshots on Outposts. For more information about Amazon EBS snapshots and about working with snapshots in an Amazon Region, see Amazon EBS snapshots.

For more information about Amazon Outposts, see Amazon Outposts Features and the Amazon Outposts User Guide. For pricing information, see Amazon Outposts pricing.

Frequently asked questions

Prerequisites

To store snapshots on an Outpost, you must have an Outpost that is provisioned with Amazon S3 on Outposts. For more information about Amazon S3 on Outposts, see Using Amazon S3 on Outposts in the Amazon Simple Storage Service User Guide.

Considerations

Keep the following in mind when working with local snapshots.

Controlling access with IAM

You can use Amazon Identity and Access Management (IAM) policies to control the permissions that principals (Amazon accounts, IAM users, and IAM roles) have when working with local snapshots. The following are example policies that you can use to grant or deny permission to perform specific actions with local snapshots.

Enforce data residency for snapshots

The following example policy prevents all principals from creating snapshots from volumes and instances on Outpost arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef and storing the snapshot data in an Amazon Region. Principals can still create local snapshots. This policy ensures that all snapshots remain on the Outpost.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots"
            ],
            "Resource": "arn:aws:ec2:us-east-1::snapshot/*",
            "Condition": {
                "StringEquals": {
                    "ec2:SourceOutpostArn": "arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0"
                },
                "Null": {
                    "ec2:OutpostArn": "true"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:CreateSnapshot",
                "ec2:CreateSnapshots"
            ],
            "Resource": "*"
        }
    ]
}

Prevent principals from deleting local snapshots

The following example policy prevents all principals from deleting local snapshots that are stored on Outpost arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ec2:DeleteSnapshot"
            ],
            "Resource": "arn:aws:ec2:us-east-1::snapshot/*",
            "Condition": {
                "StringEquals": {
                    "ec2:OutpostArn": "arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DeleteSnapshot"
            ],
            "Resource": "*"
        }
    ]
}

Working with local snapshots

The following sections explain how to use local snapshots.

Rules for storing snapshots

The following rules apply to snapshot storage:

Create local snapshots from volumes on an Outpost

You can create local snapshots from volumes on your Outpost. You can choose to store the snapshots on the same Outpost as the source volume, or in the Region for the Outpost.

Local snapshots can be used to create volumes on the same Outpost only.

You can create local snapshots from volumes on an Outpost using one of the following methods.

Console

To create local snapshots from volumes on an Outpost

Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

1. In the navigation pane, choose Volumes.

2. Select the volume on the Outpost, and choose Actions, Create Snapshot.

3. (Optional) For Description, enter a brief description for the snapshot.

4. For Snapshot destination, choose Amazon Outpost. The snapshot will be created on the same Outpost as the source volume. The Outpost ARN field shows the Amazon Resource Name (ARN) of the destination Outpost.

5. (Optional) Choose Add Tag to add tags to your snapshot. For each tag, provide a tag key and a tag value.

6. Choose Create Snapshot.

Command line

To create local snapshots from volumes on an Outpost

Use the create-snapshot command. Specify the ID of the volume from which to create the snapshot, and the ARN of the destination Outpost on which to store the snapshot. If you omit the Outpost ARN, the snapshot is stored in the Amazon Region for the Outpost.

For example, the following command creates a local snapshot of volume vol-1234567890abcdef0, and stores the snapshot on Outpost arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0.

$ aws ec2 create-snapshot --volume-id vol-1234567890abcdef0 --outpost-arn arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0 --description "single volume local snapshot"

Create multi-volume local snapshots from instances on an Outpost

You can create crash-consistent multi-volume local snapshots from instances on your Outpost. You can choose to store the snapshots on the same Outpost as the source instance, or in the Region for the Outpost.

Multi-volume local snapshots can be used to create volumes on the same Outpost only.

You can create multi-volume local snapshots from instances on an Outpost using one of the following methods.

Console

To create multi-volume local snapshots from instances on an Outpost

Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

1. In the navigation pane, choose Snapshots.

2. Choose Create Snapshot.

3. For Select resource type, choose Instance.

4. For Instance ID, select the instance on the Outpost from which to create the snapshots.

5. (Optional) For Description, enter a brief description for the snapshots.

6. For Snapshot destination, choose Amazon Outpost. The snapshots will be created on the same Outpost as the source instance. The Outpost ARN shows the ARN of the destination Outpost.

7. To exclude the instance's root volume from the multi-volume snapshot set, select Exclude root volume. If you do this, Amazon EBS will not create a snapshot of the instance's root volume.

8. To exclude specific data volumes from the multi-volume snapshot set, select Exclude specific data volumes. The Attached data volumes section lists all of the data volumes that are currently attached to the selected instance.

   In the Attached data volumes section, deselect the data volumes to exclude from the multi-volume snapshot set. Only the volumes that remain selected will be included in the multi-volume snapshot set.

9. (Optional) To automatically copy tags from the source volumes to the corresponding snapshots, for Copy tags from source volume, select Copy tags. This sets snapshot metadata—such as access policies, attachment information, and cost allocation—to match the source volume.

10. (Optional) To assign additional custom tags to the snapshots, in the Tags section, choose Add tag, and then enter the key-value pair. You can add up to 50 tags.

11. Choose Create Snapshot.

    During snapshot creation, the snapshots are managed together. If one of the snapshots in the volume set fails, the other snapshots in the volume set are moved to error status.

Command line

To create multi-volume local snapshots from instances on an Outpost

Use the create-snapshots command. Specify the ID of the instance from which to create the snapshots, and the ARN of the destination Outpost on which to store the snapshots. If you omit the Outpost ARN, the snapshots are stored in the Amazon Region for the Outpost.

For example, the following command creates snapshots of the volumes attached to instance i-1234567890abcdef0 and stores the snapshots on Outpost arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0.

$ aws ec2 create-snapshots --instance-specification InstanceId=i-1234567890abcdef0 --outpost-arn arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0 --description "multi-volume local snapshots"

Create AMIs from local snapshots

You can create Amazon Machine Images (AMIs) using a combination of local snapshots and snapshots that are stored in the Region of the Outpost. For example, if you have an Outpost in us-east-1, you can create an AMI with data volumes that are backed by local snapshots on that Outpost, and a root volume that is backed by a snapshot in the us-east-1 Region.

Copy snapshots from an Amazon Region to an Outpost

You can copy snapshots from an Amazon Region to an Outpost. You can do this only if the snapshots are in the Region for the Outpost. If the snapshots are in a different Region, you must first copy the snapshot to the Region for the Outpost, and then copy it from that Region to the Outpost.

You can copy snapshots from a Region to an Outpost using one of the following methods.

Console

To copy a snapshot from an Amazon Region to an Outpost

Open the Amazon EC2 console at https://console.amazonaws.cn/ec2/.

1. In the navigation pane, choose Snapshots.

2. Select the snapshot in the Region, and choose Actions, Copy.

3. For Destination Region, choose the Region for the destination Outpost.

4. For Snapshot Destination, choose Amazon Outpost.

   The Snapshot Destination field only appears if you have Outposts in the selected destination Region. If the field does not appear, you do not have any Outposts in the selected destination Region.

5. For Destination Outpost ARN, enter the ARN of the Outpost to which to copy the snapshot.

6. (Optional) For Description, enter a brief description of the copied snapshot.

7. Encryption is enabled by default for the snapshot copy. Encryption cannot be disabled. For KMS key, choose the KMS key to use.

8. Choose Copy.

Command line

To copy a snapshot from a Region to an Outpost

Use the copy-snapshot command. Specify the ID of the snapshot to copy, the Region from which to copy the snapshot, and the ARN of the destination Outpost.

For example, the following command copies snapshot snap-1234567890abcdef0 from the us-east-1 Region to Outpost arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0.

$ aws ec2 copy-snapshot --source-region us-east-1 --source-snapshot-id snap-1234567890abcdef0 --destination-outpost-arn arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0 --description "Local snapshot copy"

Copy AMIs from an Amazon Region to an Outpost

You can copy AMIs from an Amazon Region to an Outpost. When you copy an AMI from a Region to an Outpost, all of the snapshots associated with the AMI are copied from the Region to the Outpost.

You can copy an AMI from a Region to an Outpost only if the snapshots associated with the AMI are in the Region for the Outpost. If the snapshots are in a different Region, you must first copy the AMI to the Region for the Outpost, and then copy it from that Region to the Outpost.

You can copy AMIs from a Region to an Outpost using the Amazon CLI only.

Command line

To copy an AMI from a Region to an Outpost

Use the copy-image command. Specify the ID of the AMI to copy, the source Region, and the ARN of the destination Outpost.

For example, the following command copies AMI ami-1234567890abcdef0 from the us-east-1 Region to Outpost arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0.

$ aws ec2 copy-image --source-region us-east-1 --source-image-id ami-1234567890abcdef0 --name "Local AMI copy"  --destination-outpost-arn arn:aws:outposts:us-east-1:123456789012:outpost/op-1234567890abcdef0

Create volumes from local snapshots

You can create volumes on Outposts from local snapshots. Volumes must be created on the same Outpost as the source snapshots. You cannot use local snapshots to create volumes in the Region for the Outpost.

When you create a volume from a local snapshot, you cannot re-encrypt the volume using different KMS key. Volumes created from local snapshots must be encrypted using the same KMS key as the source snapshot.

For more information, see Create a volume from a snapshot.

Launch instances from AMIs backed by local snapshots

You can launch instances from AMIs that are backed by local snapshots. You must launch Instances on the same Outpost as the source AMI. For more information, see Launch an instance on your Outpost in the Amazon Outposts User Guide.

Delete local snapshots

You can delete local snapshots from an Outpost. After you delete a snapshot from an Outpost, the Amazon S3 storage capacity used by the deleted snapshot becomes available within 72 hours after deleting the snapshot and the volumes that reference that snapshot.

Because Amazon S3 storage capacity does not become available immediately, we recommend that you use Amazon CloudWatch alarms to monitor your Amazon S3 storage capacity. Delete snapshots and volumes that you no longer need to avoid running out of storage capacity.

For more information about deleting snapshots, see Delete a snapshot.

Automate snapshots on an Outpost

You can create Amazon Data Lifecycle Manager snapshot lifecycle policies that automatically create, copy, retain, and delete snapshots of your volumes and instances on an Outpost. You can choose whether to store the snapshots in a Region or whether to store them locally on an Outpost. Additionally, you can automatically copy snapshots that are created and stored in an Amazon Region to an Outpost.

The following table provides an overview of the supported features.

For more information about creating a snapshot lifecycle that manages local snapshots, see Automating snapshot lifecycles.