How to Move an EC2 Instance to a Different Region (us-east-1 → ap-northeast-2)

There is no "move" button for EC2 instances across AWS regions — regions are fully isolated fault domains, and AWS intentionally provides no direct instance migration API. The correct path is to capture your instance as an AMI, copy that AMI to the target region, and launch a new instance from it. This post walks you through every step, including the gotchas that trip up engineers the first time.

TL;DR

StepActionKey Detail
1Create AMI from source instanceOptionally stop instance first for filesystem consistency
2Copy AMI to target regionaws ec2 copy-image --source-region us-east-1 --destination-region ap-northeast-2
3Prepare target region prerequisitesVPC, subnet, SG, key pair, instance profile
4Launch new instance from copied AMIUse aws ec2 run-instances in ap-northeast-2
5Validate & decommission sourceVerify app health, then terminate old instance and deregister old AMI

Why There Is No Direct Migration

AWS regions are physically separate infrastructure with independent control planes. An EC2 instance is bound to the Availability Zone it was launched in — its EBS volumes, ENIs, and placement groups are all region-local resources. The only portable artifact is an Amazon Machine Image (AMI), which encodes the root volume snapshot(s) and launch configuration metadata. Copying an AMI across regions replicates the underlying EBS snapshots to the target region's S3-backed snapshot store, making a fully independent copy.

Analogy: Think of your EC2 instance as a running application on a physical server in one data center. You cannot teleport the server. Instead, you take a disk image (AMI), ship that image to the new data center (copy-image), and boot a new server from it. The original server keeps running until you decide to shut it down.

Architecture: The Migration Flow

graph LR subgraph use1 [us-east-1] EC2["EC2 Instance"] AMI_SRC["AMI ami-0source"] SNAP_SRC["EBS Snapshot"] EC2 -->|"1 create-image"| AMI_SRC AMI_SRC --> SNAP_SRC end subgraph apne2 [ap-northeast-2] AMI_DST["AMI ami-0target"] SNAP_DST["EBS Snapshot copy"] EC2_NEW["New EC2 Instance"] AMI_DST --> SNAP_DST AMI_DST -->|"4 run-instances"| EC2_NEW end AMI_SRC -->|"2 copy-image"| AMI_DST PREREQ["VPC / SG / KeyPair / Instance Profile"] -->|"3 prepare"| EC2_NEW
  1. Source Instance (us-east-1): Your running EC2 instance with attached EBS volumes.
  2. Create AMI: AWS snapshots all attached EBS volumes and registers an AMI in us-east-1. The instance can remain running (crash-consistent) or be stopped first (filesystem-consistent).
  3. Copy AMI: The copy-image API replicates the EBS snapshots to ap-northeast-2 and registers a new AMI there with a new AMI ID.
  4. Target Region Prerequisites: VPC, subnets, security groups, key pair, and instance profile must exist in ap-northeast-2 before launch.
  5. Launch New Instance: A new EC2 instance is launched from the copied AMI in ap-northeast-2.
  6. Decommission Source: After validation, terminate the old instance and clean up the source AMI and snapshots.

Step-by-Step Implementation

Step 1 — Create an AMI from the Source Instance

For the cleanest disk state, stop the instance before creating the AMI. If downtime is unacceptable, you can create a running-instance AMI (crash-consistent), but ensure your application handles this gracefully.

🔽 [Click to expand] — Stop instance & create AMI (AWS CLI) 
# Optional but recommended: stop the instance first
aws ec2 stop-instances \
  --instance-ids i-0abcdef1234567890 \
  --region us-east-1

# Wait until stopped
aws ec2 wait instance-stopped \
  --instance-ids i-0abcdef1234567890 \
  --region us-east-1

# Create the AMI
aws ec2 create-image \
  --instance-id i-0abcdef1234567890 \
  --name "migration-to-apne2-$(date +%Y%m%d)" \
  --description "Pre-migration snapshot for ap-northeast-2" \
  --no-reboot \
  --region us-east-1

# Note the returned ImageId, e.g., ami-0source1234567890

Note on --no-reboot: If you already stopped the instance, --no-reboot is safe. If the instance is running and you pass --no-reboot, AWS will not reboot it before snapshotting — you get a crash-consistent image. Omitting --no-reboot on a running instance causes AWS to reboot it automatically for a cleaner snapshot.

Step 2 — Copy the AMI to ap-northeast-2

The copy-image call is made against the destination region's endpoint. The source region and source AMI ID are passed as parameters.

🔽 [Click to expand] — Copy AMI across regions 
# Copy AMI from us-east-1 to ap-northeast-2
aws ec2 copy-image \
  --source-region us-east-1 \
  --source-image-id ami-0source1234567890 \
  --name "migration-from-use1-$(date +%Y%m%d)" \
  --description "Copied from us-east-1 for migration" \
  --region ap-northeast-2

# Returns a new ImageId in ap-northeast-2, e.g., ami-0target9876543210

# Monitor copy progress (state must be 'available' before launch)
aws ec2 describe-images \
  --image-ids ami-0target9876543210 \
  --region ap-northeast-2 \
  --query 'Images[0].State'

AMI copy duration depends on the total size of the EBS snapshots. Large volumes (hundreds of GBs) can take 30–60+ minutes. Poll describe-images until State is available.

Step 3 — Prepare Target Region Prerequisites

Resources are region-scoped. Nothing from us-east-1 automatically exists in ap-northeast-2. You must provision the following before launching:

ResourceAction Required
VPC & SubnetsCreate or use the default VPC in ap-northeast-2
Security GroupsRecreate your SG rules in ap-northeast-2 (SGs are region-scoped)
Key PairImport or create a key pair in ap-northeast-2 (key pairs are region-scoped)
IAM Role & Instance ProfileIAM is a global service — your existing IAM role and its policies are available account-wide. However, you must ensure an instance profile referencing that role exists and is correctly associated when launching in ap-northeast-2. Instance profiles are IAM resources (global), but they must be explicitly specified at launch time in the target region.
Elastic IP (if needed)EIPs are region-scoped; allocate a new one in ap-northeast-2

Step 4 — Launch the New Instance in ap-northeast-2

🔽 [Click to expand] — run-instances in target region 
aws ec2 run-instances \
  --image-id ami-0target9876543210 \
  --instance-type t3.medium \
  --key-name my-apne2-keypair \
  --security-group-ids sg-0targetsg1234567 \
  --subnet-id subnet-0targetsubnet123 \
  --iam-instance-profile Name="MyExistingInstanceProfile" \
  --tag-specifications \
    'ResourceType=instance,Tags=[{Key=Name,Value=migrated-from-use1}]' \
  --region ap-northeast-2

# Note: The instance profile (e.g., "MyExistingInstanceProfile") must already
# exist in your AWS account and reference the correct IAM role for EC2.
# IAM is global, so the same role/profile is accessible, but it must be
# explicitly specified here — it is NOT automatically attached.

Step 5 — Validate and Decommission

Before terminating anything in us-east-1, run a full validation checklist:

  • ✅ Application health checks pass on the new instance's endpoint
  • ✅ All expected processes are running (systemctl status, application logs)
  • ✅ Data integrity verified (databases, file mounts, environment variables)
  • ✅ DNS / load balancer updated to point to the new region endpoint

Once validated, clean up to avoid ongoing charges:

# Terminate source instance
aws ec2 terminate-instances \
  --instance-ids i-0abcdef1234567890 \
  --region us-east-1

# Deregister source AMI
aws ec2 deregister-image \
  --image-id ami-0source1234567890 \
  --region us-east-1

# Delete source snapshots (get snapshot IDs from describe-images first)
aws ec2 delete-snapshot \
  --snapshot-id snap-0sourcesnap1234 \
  --region us-east-1

Encryption Considerations

If your source EBS volumes are encrypted with an AWS KMS key, the copy-image operation requires that you specify a KMS key in the target region. KMS keys are region-scoped — your us-east-1 KMS key cannot be used directly in ap-northeast-2.

aws ec2 copy-image \
  --source-region us-east-1 \
  --source-image-id ami-0source1234567890 \
  --name "encrypted-migration" \
  --encrypted \
  --kms-key-id arn:aws:kms:ap-northeast-2:123456789012:key/your-target-key-id \
  --region ap-northeast-2

IAM Permissions Required

The IAM principal executing these steps needs the following minimum permissions (least privilege):

🔽 [Click to expand] — Minimum IAM policy for migration 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CreateAMISource",
      "Effect": "Allow",
      "Action": [
        "ec2:CreateImage",
        "ec2:StopInstances",
        "ec2:DescribeInstances",
        "ec2:DescribeImages"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {"aws:RequestedRegion": "us-east-1"}
      }
    },
    {
      "Sid": "CopyAMITarget",
      "Effect": "Allow",
      "Action": [
        "ec2:CopyImage",
        "ec2:DescribeImages",
        "ec2:RunInstances",
        "ec2:CreateTags"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {"aws:RequestedRegion": "ap-northeast-2"}
      }
    },
    {
      "Sid": "PassInstanceProfile",
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::123456789012:role/YourEC2InstanceRole"
    }
  ]
}

Common Pitfalls

PitfallImpactFix
Launching before AMI state is availableLaunch failsPoll describe-images or use aws ec2 wait image-available
Forgetting to recreate security groupsInstance unreachableExport SG rules and recreate in ap-northeast-2 before launch
Key pair not imported to target regionCannot SSHImport public key to ap-northeast-2 via import-key-pair
KMS key not available in target regioncopy-image fails for encrypted volumesCreate or use an existing KMS key in ap-northeast-2
Not specifying instance profile at launchInstance has no IAM role attachedExplicitly pass --iam-instance-profile in run-instances
Leaving source AMI/snapshots after migrationOngoing EBS snapshot storage chargesDeregister AMI and delete snapshots post-validation

Glossary

TermDefinition
AMI (Amazon Machine Image)A template containing the OS, application, and configuration used to launch EC2 instances. The only portable unit for cross-region EC2 migration.
EBS SnapshotA point-in-time backup of an EBS volume stored in S3-backed infrastructure. AMIs reference one or more snapshots.
Instance ProfileAn IAM container that passes an IAM role to an EC2 instance at launch. IAM is global, but the profile must be explicitly specified per launch.
copy-imageThe EC2 API action that replicates an AMI (and its underlying snapshots) from one region to another.
KMS CMK (Customer Managed Key)A region-scoped encryption key in AWS Key Management Service. Cross-region AMI copies of encrypted volumes require a KMS key in the target region.

Next Steps

Related Posts

Comments

Post a Comment

Popular posts from this blog

EC2 No Internet Access in Custom VPC: Attaching an Internet Gateway and Fixing Route Tables

Launching an EC2 instance in a custom VPC only to find it cannot reach the internet is one of the most common networking pitfalls in AWS — and it almost always comes down to two missing pieces: an Internet Gateway (IGW) and a correctly configured Route Table. This post walks you through the exact architecture, the root cause, and the precise steps to fix it. TL;DR Step Action Why It Matters 1 Create and attach an Internet Gateway to your VPC Without an IGW, there is no path between your VPC and the public internet 2 Add a 0.0.0.0/0 route pointing to the IGW in your subnet's Route Table The route table is the traffic director — without this entry, outbound packets have nowhere to go 3 Assign a Public IP or Elastic IP to the EC2 instance The IGW performs NAT only for instances with a public IP address 4 Verify Security Group allows outbound traffic Security Groups are stateful firewalls; outbound rules...
Read more

EC2 SSH Connection Timeout: The Exact Security Group Rules You Need to Fix It

You've launched a fresh EC2 instance, fired up your terminal, and run ssh ec2-user@<your-ip> — only to watch the cursor hang until Connection timed out kills your hope. This is one of the most common EC2 onboarding blockers, and it almost always traces back to a misconfigured Security Group inbound rule. TL;DR Check What to Verify Correct Value Protocol Security Group inbound rule protocol TCP Port Destination port in the inbound rule 22 Source Allowed source CIDR or IP Your public IP (e.g., 203.0.113.10/32 ) or 0.0.0.0/0 for testing Instance State EC2 instance status checks 2/2 checks passed Subnet Route Table Route to Internet Gateway (public subnet) 0.0.0.0/0 → igw-xxxxxxxx Public IP / EIP Instance has a reachable public address Public IPv4 or Elastic IP assigned Why "Connection Timed Out" Specifically? A timeout (as opposed to Connection refused ) means your TC...
Read more

IAM User vs. IAM Role: Why Your EC2 Instance Should Never Use a User

Choosing between an IAM User and an IAM Role is one of the most consequential security decisions in AWS — get it wrong and you either expose long-lived credentials or block your application entirely. This post cuts through the confusion and gives you a definitive answer for the EC2-to-S3 access pattern. TL;DR — Quick Comparison Dimension IAM User IAM Role Identity type A person or a static service account An assumable identity for AWS services, users, or external principals Credential type Long-lived Access Key ID + Secret Access Key Short-lived, auto-rotating STS tokens (max 12 h by default) Credential rotation Manual — you must rotate keys yourself Automatic — AWS rotates them transparently Stored on EC2? Yes — in ~/.aws/credentials or env vars (risky) No — delivered via the In...
Read more