Sharing your Amazon resources

Open the Settings page in the Amazon RAM console.

Choose Enable sharing with Amazon Organizations, and then choose Save settings.

Open the Amazon RAM console.

Because Amazon RAM resource shares exist in specific Amazon Web Services Regions, choose the appropriate Amazon Web Services Region from the dropdown list in the upper-right corner of the console. To see resource shares that contain global resources, you must set the Amazon Web Services Region to US East (N. Virginia), (us-east-1). For more information about sharing global resources, see Sharing Regional resources compared to global resources. If you want to include global resources in the resource share, then you must choose the designated home Region, US East (N. Virginia), us-east-1.

If you're new to Amazon RAM, choose Create a resource share from the home page. Otherwise, choose Create resource share from the Shared by me : Resource shares page.

In Step 1: Specify resource share details, do the following:

1. For Name, enter a descriptive name for the resource share.

2. Under Resources, choose resources to add to the resource share as follows:

   • For Select resource type, choose the type of resource to share. This filters the list of shareable resources to only those resources of the selected type.

   • In the resulting list of resources, select the checkboxes next to the individual resources that you want to share. The selected resources move under Selected resources.

     If you're sharing resources that are associated with a specific availability zone, then using the Availability Zone ID (AZ ID) helps you determine the relative location of these resources across accounts. For more information, see Availability Zone IDs for your Amazon resources.

3. (Optional) To attach tags to the resource share, under Tags, enter a tag key and value. Add others by choosing Add new tag. Repeat this step as needed. These tags apply to only the resource share itself, not to the resources in the resource share.

Choose Next.

In Step 2: Associate a managed permission with each resource type, you can choose to associate a managed permission created by Amazon with the resource type, choose an existing customer managed permission, or you can create your own customer managed permission for supported resource types. For more information, see Types of managed permissions.

Choose Create customer managed permission to construct a customer managed permission that meets the requirements of your sharing use case. For more information see Create a customer managed permission. After completing the process, choose and then you can select your new customer managed permission from the Managed permissions dropdown list.

To display the actions that the managed permission allows, expand View the policy template for this managed permission.

Choose Next.

In Step 3: Grant access to principals, do the following:

1. By default, Allow sharing with anyone is selected, which means that, for those resource types that support it, you can share resources with Amazon Web Services accounts that are outside of your organization. This doesn't affect resource types that can be shared only within an organization, such as Amazon VPC subnets. You can also share some supported resource types with IAM roles and users.

   To restrict resource sharing to only accounts and principals in your organization, choose Allow sharing only within your organization.

2. For Principals, do the following:

   • To add the organization, an organizational unit (OU), or an Amazon Web Services account that is part of an organization, turn on Display organizational structure. This displays a tree view of your organization. Then, select the checkbox next to each principal that you want to add.

     Important

     When you share with an organization or an OU, and that scope includes the account that owns the resource share, all principals in the sharing account automatically get access to the resources in the share. The access granted is defined by the managed permissions associated with the share. This is because the resource-based policy that Amazon RAM attaches to each resource in the share uses "Principal": "*". For more information, see Implications of using "Principal": "*" in a resource-based policy.

     Principals in the other consuming accounts don't immediately get access to the share's resources. The other accounts' administrators must first attach identity-based permission policies to the appropriate principals. Those policies must grant Allow access to the ARNs of individual resources in the resource share. The permissions in those policies can't exceed those specified in the managed permission associated with the resource share.

     • If you select the organization (the ID begins with o-), then principals in all Amazon Web Services accounts in the organization can access the resource share.

     • If you select an OU (the ID begins with ou-), then principals in all Amazon Web Services accounts in that OU and its child OUs can access the resource share.

     • If you select an individual Amazon Web Services account, then only principals in that account can access the resource share.

     Note

     The Display organizational structure toggle appears only if sharing with Amazon Organizations is enabled and you're signed in to the management account for the organization.

     You can't use this method to specify an Amazon Web Services account outside your organization, or an IAM role or user. Instead, you must turn off Display organizational structure and use the drop down list and text box to enter the ID or ARN.

   • To specify a principal by ID or ARN, including principals that are outside of the organization, then for each principal, select the principal type. Next, enter the ID (for an Amazon Web Services account, organization, or OU) or ARN (for an IAM role or user), and then choose Add. The available principal types and ID and ARN formats are as follows:

     • Amazon Web Services account – To add an Amazon Web Services account, enter the 12-digit account ID. For example:

       123456789012

     • Organization – To add all of the Amazon Web Services accounts in your organization, enter the ID of the organization. For example:

       o-abcd1234

     • Organizational unit (OU) – To add an OU, enter the ID of the OU. For example:

       ou-abcd-1234efgh

     • IAM role – To add an IAM role, enter the ARN of the role. Use the following syntax:

       arn:partition:iam::account:role/role-name

       For example:

       arn:aws-cn:iam::123456789012:role/MyS3AccessRole

       Note

       To obtain the unique ARN for an IAM role, view the list of roles in the IAM console, use the get-role Amazon CLI command or the GetRole API action.

     • IAM user – To add an IAM user, enter the ARN of the user. Use the following syntax:

       arn:partition:iam::account:user/user-name

       For example:

       arn:aws-cn:iam::123456789012:user/bob

       Note

       To obtain the unique ARN for an IAM user, view the list of users in the IAM console, use the get-user Amazon CLI command, or the GetUser API action.

   • Service principal – To add a service principal, choose Service principal from the Select principal type dropbox. Enter the Amazon service principal's name. Use the following syntax:

     • service-id.amazonaws.com

       For example:

       pca-connector-ad.amazonaws.com

3. For Selected principals, verify that the principals you specified appear in the list.

Choose Next.

In Step 4: Review and create, review the configuration details for your resource share. To change the configuration for any step, choose the link that corresponds to the step you want to go back to and make the required changes.

After you finish reviewing the resource share, choose Create resource share.

It can take a few minutes for the resource and principal associations to complete. Allow this process to complete before you try to use the resource share.

You can add and remove resources and principals or apply custom tags to your resource share at any time. You can change the managed permission for resource types that are included in your resource share, for those types that support more than the default managed permission. You can delete your resource share when you no longer want to share the resources. For more information, see Share Amazon resources owned by you.