AWS Resource Access Manager FAQs

Q: What is AWS Resource Access Manager?

A: AWS Resource Access Manager (AWS RAM) helps you securely share your resources across AWS accounts, within your organization or organizational units (OUs) in AWS Organizations, and with IAM roles and IAM users for supported resource types. You can use AWS RAM to share resources with other AWS accounts. This eliminates the need to provision and manage resources in every account. When you share a resource with another account, that account is granted access to the resource and any policies and permissions in that account apply to the shared resource.

Q: What types of AWS resources can I share using AWS RAM?

A: For information about the resource types that you can share by using AWS RAM, see shareable AWS resources in the AWS Resource Access Manager User Guide.

Q: How can I get started with AWS RAM?

A: You can get started with AWS RAM by creating a resource share using the AWS RAM Console, AWS RAM APIs, AWS CLI, or AWS SDKs. You can easily share resources by adding resources to a resource share, choosing a managed permission to associate with each resource type, and specifying whom you want to have access to the resources.

Q: Who can I share resources with?

A: You can share resources with any AWS account. If you are part of an organization in AWS Organizations and sharing within your organization is enabled, you can also share resources with OUs or your entire organization. For supported resource types, you can also share resources with IAM roles and IAM users. If you share resources with accounts that are outside of your organization, those accounts receive an invitation to join the resource share. After they accept the invitation, they can start using the shared resources.

Q: What are managed permissions?

A: A managed permission defines which actions can be performed, under which conditions, and by which principals for supported resource types in a resource share. You can associate either an AWS managed permission or a customer managed permission with each resource type in a resource share using AWS RAM. For more information, see Using managed permissions with AWS RAM.

Q: What are AWS managed permissions and when should I use them?

A: AWS managed permissions are created and maintained by AWS and grant permissions for many common customer scenarios. Every resource type has a default AWS managed permission. Some resource types provide additional AWS managed permissions from which you can select. For example, when you share the AWS Private Certificate Authority (Private CA) resource type, you can enable specific team members to issue client certificates without granting them the privileges to revoke the certificate. You can then share the same Private CA resource with an administrator using an AWS managed permission with privileges to revoke the certificate. For more information, see AWS managed permissions.

Q: What are customer managed permissions and when should I use them?

Customer managed permissions are permissions that you author and maintain by precisely specifying who can do what under which conditions with resources shared using AWS RAM. For example, when you share Amazon Virtual Private Cloud IP Address Manager (IPAM) pools, which help you manage your IP addresses at scale, you can create and tailor customer managed permissions so that your developers can assign IP addresses but not view the range of IP addresses other developer accounts assign. You can follow the best practice of least privilege, granting only the permissions required to perform tasks on shared resources. For more information, see customer managed permissions.

Q: How can I view resources that have been shared with my account?

A: You can view resources that are shared with your account in the AWS RAM console or by using the AWS RAM APIs, AWS CLI, or AWS SDKs. The resources that are shared with your account also appear in the respective resource console pages and the respective List/Describe APIs for those resource types. For example, when an Amazon Route 53 Resolver rule is shared with an account, that rule appears on the Resolver page of the Amazon Route53 console along with the other rules owned by that AWS account. In addition, if you use the Amazon Route 53 ListResolverRules API action, the shared rule is also returned in the response.

Q: Will I incur any charges for sharing my resources with other AWS accounts?

A: No. You can share resources at no additional cost.

Q: How can I control access to resources shared with me?

A: You can specify IAM policies to control access to resources shared with you.

Q: Can I stop sharing a resource?

A: Yes, you can stop sharing a resource by removing it from the resource share or by deleting the resource share.

Q: How can I monitor changes to resource shares?

A: All calls to AWS RAM APIs are logged in AWS CloudTrail. In addition, Amazon CloudWatch Events are triggered whenever there are changes to resource shares. For more information, see Logging and monitoring in AWS RAM, in the AWS Resource Access Manager User Guide.