AWS::RAM::Permission - Amazon CloudFormation
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).


Creates a customer managed permission for a specified resource type that you can attach to resource shares. It is created in the Amazon Web Services Region in which you call the operation.


To declare this entity in your Amazon CloudFormation template, use the following syntax:


{ "Type" : "AWS::RAM::Permission", "Properties" : { "Name" : String, "PolicyTemplate" : Json, "ResourceType" : String, "Tags" : [ Tag, ... ] } }


Type: AWS::RAM::Permission Properties: Name: String PolicyTemplate: Json ResourceType: String Tags: - Tag



Specifies the name of the customer managed permission. The name must be unique within the Amazon Web Services Region.

Required: Yes

Type: String

Pattern: [\w.-]*

Minimum: 1

Maximum: 36

Update requires: Replacement


A string in JSON format string that contains the following elements of a resource-based policy:

  • Effect: must be set to ALLOW.

  • Action: specifies the actions that are allowed by this customer managed permission. The list must contain only actions that are supported by the specified resource type. For a list of all actions supported by each resource type, see Actions, resources, and condition keys for Amazon services in the Amazon Identity and Access Management User Guide.

  • Condition: (optional) specifies conditional parameters that must evaluate to true when a user attempts an action for that action to be allowed. For more information about the Condition element, see IAM policies: Condition element in the Amazon Identity and Access Management User Guide.

This template can't include either the Resource or Principal elements. Those are both filled in by Amazon RAM when it instantiates the resource-based policy on each resource shared using this managed permission. The Resource comes from the ARN of the specific resource that you are sharing. The Principal comes from the list of identities added to the resource share.

Required: Yes

Type: Json

Update requires: Replacement


Specifies the name of the resource type that this customer managed permission applies to.

The format is <service-code>:<resource-type> and is not case sensitive. For example, to specify an Amazon EC2 Subnet, you can use the string ec2:subnet. To see the list of valid values for this parameter, query the ListResourceTypes operation.

Required: Yes

Type: String

Update requires: Replacement


Specifies a list of one or more tag key and value pairs to attach to the permission.

Required: No

Type: Array of Tag

Update requires: No interruption

Return values


When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the ARN of the permission.

For more information about using the Ref function, see Ref.


The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.


The Amazon Resource Name (ARN) of the new permission.


Specifies whether this permission is the default for new resource shares that include resources of the associated resource type.


The type of managed permission. This can be one of the following values:

  • AWS_MANAGED_PERMISSION – Amazon created and manages this managed permission. You can associate it with your resource shares, but you can't modify it.

  • CUSTOMER_MANAGED_PERMISSION – You, or another principal in your account created this managed permission. You can associate it with your resource shares and create new versions that have different permissions.


The version number for this version of the permission.

See also