Home / AWS / Fix AWS RDS Snapshot Sharing Failed

AWS

Fix AWS RDS Snapshot Sharing Failed

Resolve RDS snapshot sharing failures by sharing KMS encryption keys, checking IAM permissions, and configuring cross-account access.

Published: Apr 2, 20266 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

RDS snapshots can be shared with other AWS accounts for data migration, development, or disaster recovery. When sharing fails, especially for encrypted snapshots, the target account can't restore the database, blocking cross-account workflows.

Symptoms

Snapshot sharing failed:

```bash $ aws rds modify-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --attribute-name restore \ --values-to-add 123456789012

An error occurred (InvalidParameter) when calling the ModifyDBSnapshotAttribute operation: Cannot share encrypted snapshot without sharing KMS key ```

Access denied for target account:

```bash # From target account $ aws rds describe-db-snapshots \ --snapshot-type shared \ --include-shared

# Empty result - can't see shared snapshots ```

KMS key sharing denied:

```bash $ aws kms put-key-policy \ --key-id my-key-id \ --policy-name default \ --policy file://policy.json

An error occurred (AccessDeniedException) when calling the PutKeyPolicy operation ```

Common Causes

1.KMS key not shared - Encrypted snapshot requires key access in target account
2.Snapshot not encrypted - Unencrypted snapshots have sharing limitations
3.IAM permissions missing - Target account lacks snapshot restore permission
4.Snapshot attribute wrong - Not configured for sharing
5.Account not in share list - Target account ID not added
6.KMS key policy restrictive - Key policy doesn't allow target account
7.Snapshot in wrong state - Not fully available

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check Snapshot Encryption

```bash # Check if snapshot is encrypted aws rds describe-db-snapshots \ --db-snapshot-identifier my-snapshot \ --query 'DBSnapshots[*].[StorageEncrypted,KmsKeyId]'

# If encrypted, MUST share KMS key with target account # If not encrypted, can share directly (with limitations) ```

```bash # For unencrypted snapshots aws rds modify-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --attribute-name restore \ --values-to-add 123456789012

# Verify sharing aws rds describe-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --query 'DBSnapshotAttributesResult.DBSnapshotAttributes' ```

```bash # Get KMS key ID from snapshot aws rds describe-db-snapshots \ --db-snapshot-identifier my-snapshot \ --query 'DBSnapshots[0].KmsKeyId'

# Get current key policy aws kms get-key-policy \ --key-id KEY_ID \ --policy-name default

# Update key policy to allow target account # Add statement to allow target account to decrypt: { "Sid": "AllowTargetAccount", "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::TARGET_ACCOUNT_ID:root" }, "Action": [ "kms:Decrypt", "kms:DescribeKey" ], "Resource": "*" } ```

Apply key policy:

bash

aws kms put-key-policy \
  --key-id KEY_ID \
  --policy-name default \
  --policy file://updated-policy.json

```bash # After sharing KMS key, share the snapshot aws rds modify-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --attribute-name restore \ --values-to-add TARGET_ACCOUNT_ID

# Verify snapshot is shared aws rds describe-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --query 'DBSnapshotAttributesResult.DBSnapshotAttributes[?AttributeName==restore].AttributeValues' ```

Step 5: Target Account - Verify Access

```bash # From target account aws rds describe-db-snapshots \ --snapshot-type shared \ --include-shared \ --query 'DBSnapshots[*].[DBSnapshotIdentifier,SharedAccounts]'

# Should see the shared snapshot ```

Step 6: Target Account - Check IAM Permissions

```bash # Target account needs these permissions: # - rds:DescribeDBSnapshots # - rds:RestoreDBInstanceFromDBSnapshot

# Verify current user has permissions aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier restored-instance \ --db-snapshot-identifier arn:aws:rds:SOURCE_REGION:SOURCE_ACCOUNT:snapshot:my-snapshot ```

Step 7: Target Account - Restore Snapshot

```bash # Restore shared snapshot aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier restored-instance \ --db-snapshot-identifier my-snapshot \ --source-db-snapshot-identifier arn:aws:rds:us-west-2:SOURCE_ACCOUNT:snapshot:my-snapshot

# For encrypted snapshots, specify KMS key aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier restored-instance \ --db-snapshot-identifier my-snapshot \ --source-db-snapshot-identifier arn:aws:rds:us-west-2:SOURCE_ACCOUNT:snapshot:my-snapshot \ --kms-key-id TARGET_KEY_ID ```

```bash # Remove account from share list aws rds modify-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --attribute-name restore \ --values-to-remove TARGET_ACCOUNT_ID

# Remove KMS key access # Update key policy to remove target account statement ```

```bash # WARNING: Share with all accounts (not recommended for production) aws rds modify-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --attribute-name restore \ --values-to-add all

# Better: Share with specific Organization aws rds modify-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --attribute-name restore \ --values-to-add arn:aws:organizations::ACCOUNT_ID:organization/o-ORG_ID ```

Step 10: Check Snapshot Status

```bash # Snapshot must be "available" to share aws rds describe-db-snapshots \ --db-snapshot-identifier my-snapshot \ --query 'DBSnapshots[*].Status'

# If status is "creating", wait for completion aws rds wait db-snapshot-available \ --db-snapshot-identifier my-snapshot ```

1.For encrypted snapshots, target account must have:
2.KMS key policy allowing target account kms:Decrypt and kms:DescribeKey
3.IAM policy allowing target account users kms:Decrypt
4.Snapshot shared with target account

Verification

```bash # Source account - verify sharing aws rds describe-db-snapshot-attributes \ --db-snapshot-identifier my-snapshot \ --query 'DBSnapshotAttributesResult.DBSnapshotAttributes'

# Target account - verify access aws rds describe-db-snapshots \ --snapshot-type shared \ --include-shared

# Target account - test restore aws rds restore-db-instance-from-db-snapshot \ --db-instance-identifier test-restore \ --db-snapshot-identifier shared-snapshot \ --source-db-snapshot-identifier arn:aws:rds:SOURCE_REGION:SOURCE_ACCOUNT:snapshot:my-snapshot ```

[Fix AWS RDS Snapshot Restore Failed](/articles/fix-aws-rds-snapshot-restore-failed)
[Fix AWS KMS Key Access Denied](/articles/fix-aws-kms-key-access-denied)
[Fix AWS RDS Cross Account Replication](/articles/fix-aws-rds-cross-account-replication)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS RDS Snapshot Sharing Failed AWS RDS Snapshot Sharing Failed AWS AWS RDS Snapshot Sharing Failed troubleshooting AWS RDS Snapshot Sharing Failed fix Resolve RDS snapshot sharing failures by sharing KMS encryption keys, checking IAM permissions, and configuring cross-account access AWS Resolve RDS snapshot sharing failures by sharing KMS encryption keys, checking IAM permissions, and configuring cross-account access

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 2, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS RDS Snapshot Sharing Failed

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Snapshot Encryption

Step 5: Target Account - Verify Access

Step 6: Target Account - Check IAM Permissions

Step 7: Target Account - Restore Snapshot

Step 10: Check Snapshot Status

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS RDS Snapshot Sharing Failed

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check Snapshot Encryption

Step 2: Share Unencrypted Snapshot

Step 3: Share KMS Key for Encrypted Snapshot

Step 4: Share Encrypted Snapshot

Step 5: Target Account - Verify Access

Step 6: Target Account - Check IAM Permissions

Step 7: Target Account - Restore Snapshot

Step 8: Remove Snapshot Sharing

Step 9: Share with All AWS Accounts (Public)

Step 10: Check Snapshot Status

KMS Key Sharing Requirements

Verification

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading