AWS Resource Access Manager (RAM)
Sharing resources across accounts: resource shares with accounts, OUs, organizations, and IAM principals, sharing within AWS Organizations without invitations, shareable resources such as subnets (VPC sharing), transit gateways, prefix lists, Route 53 Resolver rules, and License Manager configurations, managed permissions, the Regional scope, and cost.
3 min read · Last reviewed · SAA-C03
Sign in to bookmark tutorials and track what you have read.
On this page
What it is
AWS Resource Access Manager (AWS RAM) helps you securely share your resources across AWS accounts, within your organization or OU (Organizational unit)A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.Glossary entry, and with IAM roles and users for supported resource types. You create a resource once in one account and use RAM to make it usable by other accounts, instead of duplicating it in each account. RAM has no additional charge; you pay for the shared resources themselves.
Choose RAM when a question asks how to share a SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry, transit gateway, or other resource with other accounts, for example to build a centrally managed network that many application accounts use.
Concepts
- Resource share: the resources to share, the PrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entry to share with, and the permissions they get.
- Principals:
- Specific AWS accounts.
- An OU, or the entire organization in AWS Organizations.
- For some resource types, IAM roles and users.
- Within AWS Organizations: after you enable sharing with AWS Organizations, principals in your organization get access without invitations. Sharing with accounts outside the organization uses invitations they must accept.
- Managed permissions define what the principals can do with the shared resource.
- Regional: principals can use shared resources only in the AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry where the resources were created.
- Sharing doesn't change the permissions or quotas that apply to the resource in the owning account.
Commonly shared resources
- Subnets (VPC sharing): a central account owns the VPC and shares subnets with other accounts in the same organization. These participant accounts launch their own EC2 instances, RDS databases, Redshift clusters, and Lambda functions into the shared subnets, while the network stays centrally managed.
- Transit gateways: share one transit gateway so other accounts can attach their VPCs.
- Prefix lists, Route 53 Resolver rules and DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry Firewall rule groups, License Manager configurations, Aurora DB clusters (for cloning), and many more resource types.
RAM or another option?
| If the requirement is | Choose |
|---|---|
| Many accounts deploy into one centrally managed VPC | RAM subnet sharing (VPC sharing) |
| Other accounts attach VPCs to our transit gateway | RAM transit gateway sharing |
| Give another account access to an S3 bucket or KMS key | Resource-based policyA permissions policy attached to a resource, such as an S3 bucket policy or an SQS queue policy, that says which principals can use it, including principals in other accounts. Identity-based policies, in contrast, attach to users, groups, and roles.Glossary entry |
| Connect two VPCs owned by different accounts | VPC peering or Transit Gateway |
| Let users in another account assume permissions | Cross-account IAM role |
Reverse mindmap: when the question points here
- Yes, when the question says
- Share subnets with other accounts leads to RAM, VPC sharing
- Central networking account, app accounts launch into its VPC leads to VPC sharing
- Share a transit gateway across accounts leads to RAM
- Share Route 53 Resolver rules with all accounts leads to RAM
- Share License Manager configurations leads to RAM
- Know the rules
- No invitations inside the organization leads to Enable sharing with AWS Organizations
- Works in which Region leads to Only the resource's own Region
- No, when the question says
- Share an S3 bucket leads to Bucket policy
- Connect two VPCs leads to Peering or Transit Gateway
Key takeaways
- AWS RAM shares resources across accounts, OUs, organizations, and (for some types) IAM principals, at no extra charge.
- Inside AWS Organizations, sharing needs no invitations once enabled.
- VPC sharing lets participant accounts launch resources into subnets owned by a central account in the same organization.
- Commonly shared: subnets, transit gateways, prefix lists, Route 53 Resolver rules, and License Manager configurations.
- Shares are Regional and don't change the owner's permissions or quotas.
Sources
- AWS RAM User Guide: What is AWS Resource Access Manager?
- AWS RAM User Guide: Sharing your AWS resources
- AWS RAM User Guide: Creating a resource share
- AWS RAM User Guide: Managing permissions in AWS RAM
- AWS RAM User Guide: Shareable AWS resources
- Amazon VPC User Guide: Share your VPC subnets with other accounts