AWS Resource Access Manager Specialized2018年〜
Securely share AWS resources with other accounts within your organization
What It Does
AWS Resource Access Manager (RAM) lets you securely share AWS resources with other accounts or OUs (organizational units) within your organization. You can share Transit Gateways, subnets, Route 53 Resolver rules, License Manager configurations, Aurora DB clusters, and more - avoiding duplicate resource creation and reducing costs.
Use Cases
Sharing Transit Gateways across the organization, providing shared VPC subnets, centrally managing Route 53 Resolver rules, and applying license configurations organization-wide.
Everyday Analogy
Think of shared office equipment. Instead of each department (account) buying its own printer (resource), you set up a shared printer (RAM-shared resource) that all departments can use. Management is handled by the facilities team (resource owner).
What Is RAM?
AWS RAM simplifies resource sharing. Previously, providing resources to other accounts required creating the same resource in each account or setting up cross-account IAM roles. With RAM, the resource owner simply specifies who to share with, and the target accounts can use the resource directly.
Shareable Resources and Permissions
RAM supports sharing a wide range of resources including Transit Gateways, VPC subnets, Route 53 Resolver rules, License Manager configurations, Aurora DB clusters, and CodeBuild projects. You can share with specific account IDs, OUs, or the entire organization. Permissions on shared resources are controlled by AWS-managed permissions, preventing excessive access for recipients. For real-world examples and best practices on shareable resources and permissions, specialized books on Amazon are a useful reference.
Getting Started
In the RAM console, select "Create resource share" and specify the resources to share and the recipients (account IDs, OUs). Sharing within an Organization is auto-approved. Sharing with accounts outside the organization requires recipient approval.
Things to Watch Out For
- RAM itself is free. Usage charges for shared resources are billed to the resource owner's account
- Enabling trusted access in Organizations allows auto-approval for intra-organization sharing
