Sharing your AWS resources

To enable resource sharing within AWS Organizations

1. Open the Settings page in the AWS RAM console.

2. Choose Enable sharing with AWS Organizations, and then choose Save settings.

To create a resource share

1. Open the AWS RAM console.

2. Because AWS RAM resource shares exist in specific AWS Regions, choose the appropriate AWS Region from the dropdown list in the upper-right corner of the console. To see resource shares that contain global resources, you must set the AWS Region to US East (N. Virginia), (us-east-1). For more information about sharing global resources, see Sharing Regional resources compared to global resources. If you want to include global resources in the resource share, then you must choose the designated home Region, US East (N. Virginia), us-east-1.

3. If you're new to AWS RAM, choose Create a resource share from the home page. Otherwise, choose Create resource share from the Shared by me : Resource shares page.

4. In Step 1: Specify resource share details, do the following:

   1. For Name, enter a descriptive name for the resource share.

   2. Under Resources, choose resources to add to the resource share as follows:

      • For Select resource type, choose the type of resource to share. This filters the list of shareable resources to only those resources of the selected type.

      • In the resulting list of resources, select the check boxes next to the individual resources that you want to share. The selected resources move under Selected resources.

        If you're sharing resources that are associated with a specific availability zone, then using the Availability Zone ID (AZ ID) helps you determine the relative location of these resources across accounts. For more information, see Availability Zone IDs for your AWS resources.

   3. (Optional) To attach tags to the resource share, under Tags, enter a tag key and value. Add others by choosing Add new tag. Repeat this step as needed. These tags apply to only the resource share itself, not to the resources in the resource share.

5. Choose Next.

6. In Step 2: Associate a permission with each resource type, if more than the default AWS RAM managed permission is available, then you can choose which permission to associate with the resource type. If only the default permission is available, then AWS RAM automatically associates this permission with the resource type. For more information, see Types of AWS RAM managed permissions.

   To display the actions that the permission allows, expand View the actions that are allowed by this permission.

7. Choose Next.

8. In Step 3: Choose principals to grant access, do the following:

   1. By default, Allow sharing with external principals is selected, which means that you can share resources with AWS accounts that are outside of your organization. For supported resource types, you can also share resources with IAM roles and users.

      To restrict resource sharing to only principals in your organization, choose Allow sharing with principals in your organization only.

   2. For Principals, do the following:

      • To add the organization, an organizational unit (OU), or an AWS account that is part of an organization, turn on Display organizational structure. This displays a tree view of your organization. Then, select the check box next to each principal that you want to add.

        • If you select the organization (the ID begins with o-), then all AWS accounts in the organization can access the resource share.

        • If you select an OU (the ID begins with ou-), then all AWS accounts in that OU and its child OUs can access the resource share.

        • If you select an individual AWS account, then only that account can access the resource share.

        Note

        The Display organizational structure toggle appears only if sharing with AWS Organizations is enabled and you're signed in to the management account for the organization.

        You can't use this method to specify an AWS account outside your organization, or an IAM role or IAM user. Instead, you must turn off Display organizational structure and use the dropdown list and text box to enter the ID or ARN.

      • To specify a principal by ID or ARN, including principals that are outside of the organization, then for each principal, select the principal type. Next, enter the ID (for an AWS account, organization, or OU) or ARN (for an IAM user or role), and then choose Add. The available principal types and ID and ARN formats are as follows:

        • AWS account – To add an AWS account, enter the 12-digit account ID. For example:

          123456789012

        • Organization – To add all of the AWS accounts in your organization, enter the ID of the organization. For example:

          o-abcd1234

        • Organizational unit (OU) – To add an OU, enter the ID of the OU. For example:

          ou-abcd-1234efgh

        • IAM role – To add an IAM role, enter the ARN of the role. Use the following syntax.

          arn:partition:iam::account:role/role-name

          For example:

          arn:aws:iam::123456789012:role/MyS3AccessRole

          Note

          To obtain the unique ARN for an IAM role, view the list of roles in the IAM console, use the get-role AWS CLI command or the GetRole API action.

        • IAM user – To add an IAM user, enter the ARN of the user. Use the following syntax.

          arn:partition:iam::account:user/user-name

          For example:

          arn:aws:iam::123456789012:user/JohnDoe

          Note

          To obtain the unique ARN for an IAM user, view the list of users in the IAM console, use the get-user AWS CLI command or the GetUser API action.

   3. For Selected principals, verify that the principals you specified appear in the list.

9. Choose Next.

10. In Step 4: Review and create, review the configuration details for your resource share. To change the configuration for any step, choose the link that corresponds to the step you want to go back to and make the required changes.

11. After you finish reviewing the resource share, choose Create resource share.

    It can take a few minutes for the resource and principal associations to complete. Allow this process to complete before you try to use the resource share.

12. You can add and remove resources and principals or apply custom tags to your resource share at any time. You can change permission for resource types that are included in your resource share, for those types that support more than the default permission. You can delete your resource share when you no longer want to share the resources. For more information, see Share AWS resources owned by you.