The Wayback Machine - https://web.archive.org/web/20220120030953/http://docs.aws.amazon.com/ram/latest/userguide/what-is.html
What is AWS Resource Access Manager? - AWS Resource Access Manager
BenefitsHow resource sharing worksService quotasAccessing AWS RAMPricing

What is AWS Resource Access Manager?

AWS Resource Access Manager (AWS RAM) helps you securely share the AWS resources that you create in one AWS account with other AWS accounts. If you have multiple AWS accounts, you can create a resource once and use AWS RAM to make that resource accessible to those other accounts. If your account is managed by AWS Organizations, then you can share resources with all of the other accounts in the organization, or only those contained by one or more specified organizational units (OUs). You can also share with specific AWS accounts by account ID, regardless of whether the account is part of an organization. Some supported resource types also let you share them with specified IAM roles and users.

Benefits

Why use AWS RAM? It offers the following benefits:

  • Reduces your operational overhead – Create a resource once, and then use AWS RAM to share that resource with other accounts. This eliminates the need to provision duplicate resources in every account, which reduces operational overhead.

  • Provides security and consistency – Simplify security management for your shared resources by using a single set of policies and permissions. If you were to instead create duplicate resources in all of your separate accounts, you would have the task of implementing identical policies and permissions, and then have to keep them identical across all of those accounts. Instead, all users of an AWS RAM resource share are managed by a single set of policies and permissions. AWS RAM offers a consistent experience for sharing different types of AWS resources.

  • Provides visibility and auditability – View the usage details for your shared resources through the integration of AWS RAM with Amazon CloudWatch and AWS CloudTrail. AWS RAM provides comprehensive visibility into shared resources and accounts.

What about cross-account access with resource-based policies?

You can share some types of AWS resources with other AWS accounts by attaching a resource-based permission policy that identifies principals outside of your AWS account. However, sharing a resource by attaching a policy doesn't take advantage of the additional benefits that AWS RAM provides. By using AWS RAM you get the following features:

  • You can share with an organization or an organizational unit (OU) without having to enumerate every one of the AWS account IDs. All principals in the relevant AWS accounts automatically get access to the resources in such a resource share.

  • Users can see the resources shared with them directly in the originating AWS service console and API operations as if those resources were directly in the user's account. For example, if you share a Amazon VPC subnet with another account, users in that account can see the subnet in the Amazon VPC console and in the results of Amazon VPC API operations performed in that account. Resources shared by policy aren't visible this way; instead, you have to discover and explicitly refer to the resource by its ARN.

  • The owners of a resource can see which principals have access to each individual resource that they have shared.

  • If you share resources with an account that is not part of your organization, then an invitation process is initiated. The recipient must accept the invitation before access to the resources is granted. Sharing within an organization doesn't require an invitation.

If you have resources that you have shared by using a resource-based permission policy, you can "promote" those resources to fully AWS RAM-managed resources by using the PromoteResourceShareCreatedFromPolicy API operation, or its CLI equivalent, promote-resource-share-created-from-policy.

How resource sharing works

When you share a resource with another AWS account, you are granting access to principals in that account to the shared resource. Any policies and permissions that apply to the account you shared the resource with also apply to the shared resource. The resources in the share look like they are native resources in the AWS accounts you shared them with.

You can share both global and Regional resources. For more information, see Sharing Regional resources compared to global resources.

Sharing your resources

With AWS RAM, you share resources that you own by creating a resource share. To create a resource share, you specify the following:

  • The AWS Region in which you want to create the resource share. In the console, you choose from the Region drop-down menu in the upper-right corner of the console. In the AWS CLI, you use the --region parameter.

    • A resource share can contain only Regional resources that are in the same AWS Region as the resource share.

    • A resource share can contain global resources only if the resource share is in the designated home Region, US East (N. Virginia), us-east-1.

  • A name for the resource share.

  • The list of resources that you want to grant access to as part of this resource share.

  • The principals to which you grant access to the resource share. Principals can be individual AWS accounts, the accounts in an organization or an organizational unit (OU) in AWS Organizations, or individual AWS Identity and Access Management (IAM) roles or users.

    Note

    Not all resource types can be shared with IAM roles and users. For information about resources that you can share with these principals, see Shareable AWS resources.

  • The AWS RAM permission to associate with each resource type. This is an AWS managed permission policy that determines what the principals in the other accounts can do with the resources in the resource share.

Your account retains full ownership of the resources that you share.

Using shared resources

When the owner of a resource shares it with your account, you can access the shared resource just as you would if it was owned by your account. You can access the resource by using the relevant service's console, AWS Command Line Interface (AWS CLI) commands, and API operations. The API operations that principals in your account are allowed to perform vary depending on the resource type and are specified by the AWS RAM permission attached to the resource share. All IAM policies and service control policies configured in your account also continue to apply, which enables you to make use of your existing investments in security and governance controls.

When you access a shared resource using that resource's service, you have the same abilities and limitations as the AWS account that owns the resource.

  • If the resource is Regional, then you can access it from only the AWS Region in which it exists in the owning account.

  • If the resource is global, then you can access it from any AWS Region that the resource's service console and tools support. Note that you can view and manage the resource share and its global resources in the AWS RAM console and tools only in the designated home Region, US East (N. Virginia), us-east-1.

Service quotas

Your AWS account has the following limits related to AWS RAM. You can request an increase for some of these limits. To request a limit increase, contact AWS Support.

Resource Default limit

Maximum number of resource shares per account

5,000

Maximum number of shared principals per account

5,000

Maximum number of shared resources per account

5,000

Maximum number of pending invitations per account

20

Accessing AWS RAM

You can work with AWS RAM in any of the following ways:

AWS RAM console

AWS RAM provides a web-based user interface, the AWS RAM console. If you've signed up for an AWS account, you can access the AWS RAM console by signing into the AWS Management Console and choosing AWS RAM from the console home page.

You can also navigate in your browser directly to the AWS RAM console. If you aren't already signed in, then you're asked to do so before the console appears.

AWS CLI and Tools for Windows PowerShell

The AWS CLI and Tools for PowerShell provide direct access to the AWS RAM public API operations. They are supported on Windows, macOS, and Linux. For more information about getting started, see the AWS Command Line Interface User Guide, or the AWS Tools for Windows PowerShell User Guide. For more information about the commands for AWS RAM, see the AWS CLI Command Reference or the AWS Tools for Windows PowerShell Cmdlet Reference.

AWS SDKs

AWS provides API commands for a broad set of programming languages. For more information about getting started, see AWS SDKs and Tools Reference Guide.

Query API

If you don't use one of the supported programming languages, then the AWS RAM HTTPS Query API gives you programmatic access to AWS RAM and AWS. With the AWS RAM API, you can issue HTTPS requests directly to the service. When you use the AWS RAM API, you must include code to digitally sign requests using your credentials. For more information, see the AWS RAM API Reference.

Pricing

There are no additional charges for using AWS RAM or for creating resource shares and sharing your resources across accounts. Resource usage charges vary depending on the resource type. For more information about how shareable resources are billed, refer to the documentation for the resource's owning service.