Share Image Builder resources with Amazon RAM - EC2 Image Builder
Resource ownersResource consumers
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Share Image Builder resources with Amazon RAM

EC2 Image Builder integrates with Amazon Resource Access Manager (Amazon RAM) so that you can share the following types of Image Builder resources with any Amazon Web Services account or through Amazon Organizations.

  • Components

  • Images

  • Recipes

To share resources through Amazon RAM, you must create a resource share. A resource share specifies the resources to share and the consumers with whom to share them. Consumers can be individual Amazon Web Services accounts, organizational units, or an entire organization in Amazon Organizations. The following list includes the types of accounts and organizations that you can share with.

  • Specific Amazon Web Services accounts inside or outside of its organization in Amazon Organizations.

  • An organizational unit (OU) inside of its organization in Amazon Organizations.

  • Its entire organization in Amazon Organizations.

  • Amazon Organizations or OUs outside of its organization.

In this model, the Amazon Web Services account that owns the resource (owner) shares it with other Amazon Web Services accounts or through Amazon Organizations (consumers) within the same Region. When a shared resource is updated, consumers get those updates automatically.

Note

Shared components, images, and image recipes count toward the corresponding resource limits of the owner only. The resource limits of the consumers are not affected by the resources that are shared with them.

Topics

Resource owners

Image Builder resources can only be shared in the Amazon Web Services Region where they are created. When you share these resources, they will not replicate across Regions.

To get a list of the Image Builder resources that you own and can share, specify the ownership filter in the console or when you run the command in the Amazon CLI.

For more information about Amazon RAM, see the Amazon RAM User Guide.

Prerequisites for sharing Image Builder resources

To share an Image Builder resource, such as a component, image, or recipe:

  • Your Amazon Web Services account must own the Image Builder resource that you want to share. You cannot share resources that have been shared with you.

  • The Amazon Key Management Service (Amazon KMS) key associated with encrypted resources must be explicitly shared with the target accounts, organizations, or OUs.

  • If you distribute an image encrypted with Amazon KMS across accounts in different Regions, you must create a KMS key and alias in each target Region. Additionally, the people who will be launching instances in those Regions will need access to the KMS key specified via the Key Policy.

The following resources that Image Builder creates from your pipeline build are not considered Image Builder resources – rather, they are external resources that Image Builder distributes in your account, and to the Amazon Web Services Regions, accounts, and organizations or organizational units (OUs) that you specify in your distribution configuration.

  • Amazon Machine Images (AMIs)

  • Container images that reside in Amazon ECR

For more information about distribution settings for your AMI, see Create and update AMI distribution configurations. For more information about distribution settings for your container image in Amazon ECR, see Create and update distribution settings for container images.

For more information about sharing your AMI, see Shared AMIs.

Resource consumers

Consumers can use a shared resource, but cannot modify it in any way. When they create Image Builder recipes, they can specify a shared image as the base image, and they can add shared components. They can also specify a shared recipe when they create an Image Builder image pipeline, or when they use the create-image command in the Amazon CLI.

If you belong to an organization in Amazon Organizations, and sharing within your organization is enabled, consumers in your organization are automatically granted access to the shared resource. Otherwise, consumers receive an invitation to join the resource share and are granted access to the shared resource after accepting the invitation.