Sharing S3 on Outposts by using Amazon RAM - Amazon Simple Storage Service
PrerequisitesProcedureUsage examples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Sharing S3 on Outposts by using Amazon RAM

Amazon S3 on Outposts supports sharing S3 capacity across multiple accounts within an organization by using Amazon Resource Access Manager (Amazon RAM). With S3 on Outposts sharing, you can allow others to create and manage buckets, endpoints, and access points on your Outpost.

This topic demonstrates how to use Amazon RAM to share S3 on Outposts and related resources with another Amazon Web Services account in your Amazon organization.

Prerequisites

  • The Outpost owner account has an organization configured in Amazon Organizations. For more information, see Creating an organization in the Amazon Organizations User Guide.

  • The organization includes the Amazon Web Services account that you want to share your S3 on Outposts capacity with. For more information, see Sending invitations to Amazon Web Services accounts in the Amazon Organizations User Guide.

  • Select one of the following options that you want to share. The second resource (either Subnets or Outposts) must be selected so that endpoints are also accessible. Endpoints are a networking requirement in order to access data stored in S3 on Outposts.

    Option 1 Option 2

    S3 on Outposts

    Allows the user to create buckets on your Outposts and access points and to add objects to those buckets.

    Subnets

    Allows the user to use your virtual private cloud (VPC) and the endpoints that are associated with your subnet.

    S3 on Outposts

    Allows the user to create buckets on your Outposts and access points and to add objects to those buckets.

    Outposts

    Allows the user to see S3 capacity charts and the Amazon Outposts console home page. Also allows users to create subnets on shared Outposts and create endpoints.

Procedure

  1. Sign in to the Amazon Web Services Management Console by using the Amazon Web Services account that owns the Outpost, and then open the Amazon RAM console at https://console.amazonaws.cn/ram.

  2. Make sure that you have enabled sharing with Amazon Organizations in Amazon RAM. For information, see Enable resource sharing within Amazon Organizations in the Amazon RAM User Guide.

  3. Use either Option 1 or Option 2 in the prerequisites to create a resource share. If you have multiple S3 on Outposts resources, select the Amazon Resource Names (ARNs) of the resources that you want to share. To enable endpoints, share either your subnet or Outpost.

    For more information about how to create a resource share, see Create a resource share in the Amazon RAM User Guide.

  4. The Amazon Web Services account that you shared your resources with should now be able to use S3 on Outposts. Depending on the option that you selected in the prerequisites, provide the following information to the account user:

    Option 1 Option 2

    The Outpost ID

    The VPC ID

    The subnet ID

    The security group ID

    The Outpost ID

Note

The user can confirm that the resources have been shared with them by using the Amazon RAM console, the Amazon Command Line Interface (Amazon CLI), Amazon SDKs, or REST API. The user can view their existing resource shares by using the get-resource-shares CLI command.

Usage examples

After you have shared your S3 on Outposts resources with another account, that account can manage buckets and objects on your Outpost. If you shared the Subnets resource, then that account can use the endpoint that you created. The following examples demonstrate how a user can use the Amazon CLI to interact with your Outpost after you share these resources.

Example : Create a bucket

The following example creates a bucket named DOC-EXAMPLE-BUCKET1 on the Outpost op-01ac5d28a6a232904. Before using this command, replace each user input placeholder with the appropriate values for your use case.

aws s3control create-bucket --bucket DOC-EXAMPLE-BUCKET1 --outpost-id op-01ac5d28a6a232904

For more information about this command, see create-bucket in the Amazon CLI Reference.

Example : Create an access point

The following example creates an access point on an Outpost by using the example parameters in the following table. Before using this command, replace these user input placeholder values and the Amazon Web Services Region code with the appropriate values for your use case.

Parameter Value
Account ID 111122223333
Access point name example-outpost-access-point
Outpost ID op-01ac5d28a6a232904
Outpost bucket name DOC-EXAMPLE-BUCKET1
VPC ID vpc-1a2b3c4d5e6f7g8h9
Note

The Account ID parameter must be the Amazon Web Services account ID of the bucket owner, which is the shared user.

aws s3control create-access-point --account-id 111122223333 --name example-outpost-access-point \
--bucket arn:aws-cn:s3-outposts:us-east-1:111122223333:outpost/op-01ac5d28a6a232904/bucket/DOC-EXAMPLE-BUCKET1 \
--vpc-configuration VpcId=vpc-1a2b3c4d5e6f7g8h9

For more information about this command, see create-access-point in the Amazon CLI Reference.

Example : Upload an object

The following example uploads the file my_image.jpg from the user's local file system to an object named images/my_image.jpg through the access point example-outpost-access-point on the Outpost op-01ac5d28a6a232904, owned by the Amazon account 111122223333. Before using this command, replace these user input placeholder values and the Amazon Web Services Region code with the appropriate values for your use case.

aws s3api put-object --bucket arn:aws-cn:s3-outposts:us-east-1:111122223333:outpost/op-01ac5d28a6a232904/accesspoint/example-outpost-access-point \
--body my_image.jpg --key images/my_image.jpg

For more information about this command, see put-object in the Amazon CLI Reference.

Note

If this operation results in a Resource not found error or is unresponsive, your VPC might not have a shared endpoint.

To check whether there is a shared endpoint, use the list-shared-endpoints Amazon CLI command. If there is no shared endpoint, work with the Outpost owner to create one. For more information, see ListSharedEndpoints in the Amazon Simple Storage Service API Reference.

Example : Create an endpoint

The following example creates an endpoint on a shared Outpost. Before using this command, replace the user input placeholder values for the Outpost ID, subnet ID, and security group ID with the appropriate values for your use case.

Note

The user can perform this operation only if the resource share includes the Outposts resource.

aws s3outposts create-endpoint --outposts-id op-01ac5d28a6a232904 --subnet-id XXXXXX --security-group-id XXXXXXX

For more information about this command, see create-endpoint in the Amazon CLI Reference.