AWS Resource Access Manager (RAM)

Resource share in AWS RAM

In AWS RAM, resources are shared by creating a resource share. A resource share consists of three elements:

• A list of resources that need to be shared

• A list of principals (AWS accounts, IAM roles, and users, etc.) with whom we want to share our resources

• A managed permission that includes a list of actions other accounts can perform on our resources.

In the illustration below, the Aurora instance created in one account is shared with another using AWS RAM.

Principals supported in RAM

In AWS RAM, a consuming account is the AWS account with whom we want to share our resources. The principles in an AWS RAM resource share must have the IAM policy attached to the IAM role or user to access the resource. Following are the types of principals AWS RAM supports as consumers in the resource share:

• AWS account: We can provide the ID of the accounts to share our resources. For example, we can share resources with an account whose ID is 112233445566.

• IAM roles or users: We can share resources with IAM roles or users located inside another AWS account by providing their ARN, for example arn:aws:iam::112233445566:role/samplerole.

• Service principal: We can share resources with a specific AWS service.

• Accounts in an organization: We can also share resources with accounts in an organization unit or with all the accounts in an organization.

Things to keep in mind 

Following are some of the things we must keep in mind while working with AWS RAM:

• AWS RAM is a regional service. This means if we are sharing a resource located in us-east-1, we must use the same region to access that resource from some other account.

• Usually, we have 12 hours to accept the invitation to join a resource share. After this time period ends, the invitation is declined automatically.

• In case we want to delete a resource that is being shared using AWS RAM, it is recommended to first remove the resource from the resource share or delete the resource share.

Benefits of AWS RAM

AWS RAM offers the following benefits:

• Reduced operational overhead: Ee can easily share our resources across multiple accounts rather than creating the same resource again and again and duplicating its content.

• Security: AWS RAM uses a single set of policies and permissions for shared resources across multiple accounts to manage them securely and ensure a consistent user experience across all accounts.

• Usage visibility: AWS RAM can be integrated with CloudWatch or CloudTrail to monitor how our resources are shared over multiple accounts.