Cross-Account Resource Sharing with AWS RAM - Sharing VPC Subnets and Transit Gateways
Learn how to share VPC subnets and Transit Gateways across accounts to centralize IP address space management and reduce VPC peering connections.
Overview of RAM
RAM is a service that securely shares over 30 types of AWS resources across multiple accounts. In multi-account environments, each account owns its own resources, but network resources (VPC subnets, Transit Gateways) and DNS resources (Route 53 Resolver rules) are more efficient when shared. Sharing through RAM eliminates resource duplication and reduces costs.
VPC Subnet Sharing
VPC subnet sharing is a pattern where a network account owns the VPC and subnets, and workload accounts create resources (EC2, RDS, Lambda) within the shared subnets. This eliminates the need for each account to have its own VPC, preventing IP address space fragmentation. Security groups remain independent per account, so network isolation between accounts is maintained even within shared subnets. With Transit Gateway sharing, a network account owns the Transit Gateway and each account attaches its VPC.
Shareable Resources and Design Patterns
Resources shareable through RAM include over 30 types such as VPC subnets, Transit Gateways, Route 53 Resolver rules, License Manager configurations, Aurora DB clusters, and CodeBuild projects. In VPC subnet sharing, a network account owns the VPC while workload accounts create resources within shared subnets. The main benefits are centralized IP address space management and reduced VPC peering. Sharing within an Organization is automatically approved, while sharing with accounts outside the Organization requires invitation-based approval. Resource share permissions control the operations allowed for recipient accounts (read-only, create-enabled). To learn RAM management techniques comprehensively, refer to technical books on Amazon.
RAM Pricing
RAM itself incurs no additional charges. Costs depend on the usage of shared resources (consumption by recipient accounts). With VPC subnet sharing, resources created by recipient accounts (EC2, RDS) are billed to the recipient account. With Transit Gateway sharing, attachment fees and data processing fees are billed to the recipient account. Conduct regular audits of resource shares and remove unnecessary shares to reduce security risks.
Summary
RAM is a service for efficiently sharing resources in multi-account environments. VPC subnet sharing centralizes IP address space management and reduces the number of VPC peering connections. Transit Gateway sharing consolidates network connectivity, supporting over 30 resource types. Sharing within an Organization is automatically approved, and resource share permissions provide fine-grained control over operations.