An administrator created a custom EC2 instance with software and encrypted EBS volumes using AWS-managed keys. They made an AMI from that instance and want to share that AMI with other company AWS accounts. Company policy requires AMIs to be encrypted with KMS customer-managed keys and only accessible to authorized accounts. Which process securely shares the AMI while meeting the requirement?

The correct process involves several key steps to meet the security and sharing requirements. First, a new customer-managed KMS key (CMK) is created in the source account because the original AMI uses AWS-managed keys, and company policy mandates CMKs. The key policy of this new CMK must grant necessary permissions (kms:DescribeKey, kms:ReEncrypt, kms:CreateGrant, and kms:Decrypt) to the recipient accounts, allowing them to use the key for decryption. Next, a copy of the AMI is made, and crucially, this new CMK is specified during the copy operation to re-encrypt the AMI with the customer-managed key. Finally, the launch permissions of this newly copied and re-encrypted AMI are explicitly set to the target account IDs, ensuring only authorized accounts can launch instances from it. The first incorrect option fails because you cannot directly change the encryption key of an existing AMI; it must be copied with the new key. The third incorrect option makes the AMI public, which violates the security requirement of restricting access to authorized accounts. The fourth incorrect option is incorrect because AWS-managed keys cannot have their key policies modified by users, and the policy requires a customer-managed key.