Update a resource share in Amazon RAM

To update a resource share

1. Navigate to the Shared by me : Resource shares page in the Amazon RAM console.

2. Because Amazon RAM resource shares exist in specific Amazon Web Services Regions, choose the appropriate Amazon Web Services Region from the dropdown list in the upper-right corner of the console. To see resource shares that contain global resources, you must set the Amazon Web Services Region to US East (N. Virginia), (us-east-1). For more information about sharing global resources, see Sharing Regional resources compared to global resources.

3. Select the resource share and then choose Modify.

4. In Step 1: Specify resource share details, review the resource share details, and if required, update any of the following:

   1. (Optional) To change the name of the resource share, edit Name.

   2. (Optional) To add a resource to the resource share, under Resources, choose the type of resource and then select the check box next to the resource to add it to the resource share. Global resources appear only if you set the Region to US East (N. Virginia), (us-east-1) in the Amazon Web Services Management Console.

   3. (Optional) To remove a resource from the resource share, locate the resource under Selected resources, and then choose the X next to the resource's ID.

   4. (Optional) To add a tag to the resource share, under Tags, enter a tag key and value in the empty text boxes. To add more than one tag key and value pair, choose Add new tag. You can add up to 50 tags.

   5. To remove a tag from the resource share, under Tags, locate the tag and choose Remove next to it.

5. Choose Next.

6. (Optional) In Step 2: Associate a managed permission with each resource type, you can choose to associate a managed permission created by Amazon with the resource type, choose an existing customer managed permission, or you can create your own customer managed permission. For more information, see Types of managed permissions.

   You can also choose Create customer managed permission to construct a customer managed permission that meets the requirements of your sharing use case. For more information, see Create a customer managed permission. After completing the process, choose , and then you can select your new customer managed permission from the Managed permission dropdown list.

   To display the actions that the managed permission allows, expand View the policy template for this managed permission.

7. If the version of the managed permission currently assigned to the resource share isn't the current default version, then you can update to the default version by choosing Update to default version.

   Note

   Until you save your changes to the resource share after the final step, you can cancel the version update by choosing Revert to previous version. However, for Amazon managed permissions, after you save the resource share, the change is final and you can no longer return to the previous version.

8. Choose Next.

9. In Step 3: Choose principals that are allowed to access, review the selected principals, and if required, update any of the following:

   1. (Optional) To change whether sharing is enabled with principals inside or outside your organization, choose one of the following options:

      • To share resources with Amazon Web Services accounts or individual IAM roles or users that are outside of your organization, choose Allow sharing with external principals.

      • To restrict resource sharing to only principals in your organization in Amazon Organizations, choose Allow sharing with principals in your organization only.

   2. For Principals, do the following:

      • (Optional) To add an organization, organizational unit (OU), or member Amazon Web Services account inside your organization, turn on Display organizational structure to display a tree view of your organization. Then select the check box next to each principal that you want to add.

        Important

        When you share with an organization or an OU, and that scope includes the account that owns the resource share, all principals in the sharing account automatically get access to the resources in the share. The access granted is defined by the managed permissions associated with the share. This is because the resource-based policy that Amazon RAM attaches to each resource in the share uses "Principal": "*". For more information, see Implications of using "Principal": "*" in a resource-based policy.

        Principals in the other consuming accounts don't immediately get access to the share's resources. The other accounts' administrators must first attach identity-based permission policies to the appropriate principals. Those policies must grant Allow access to the ARNs of individual resources in the resource share. The permissions in those policies can't exceed those specified in the managed permission associated with the resource share.

        Note

        The Display organizational structure toggle appears only if sharing with Amazon Organizations is enabled and you are signed in as a principal in the organization's management account.

        You can't use this method to specify an Amazon Web Services account outside your organization, or an IAM role or user. Instead, you must add these principals by entering their identifiers, which are shown in the text box below the Display organizational structure switch. See the next bullet point.

      • (Optional) To add a principal by its identifier, choose the principal type from the dropdown list, and then enter the ID or ARN for the principal. Finally, choose Add.

        If you select an individual Amazon Web Services account, then only that account can access the resource share. You can choose either of the following options.

        • Another Amazon Web Services account (other than the resource owner) – Makes the resource available to the other account. The administrator of that account must complete the process by granting access to the shared resource using identity-based permission policies to individual roles and users. Those permissions can't exceed those defined in the managed permissions attached to the resource share.

        • This Amazon Web Services account (resource owner) – All roles and users in the resource owning account automatically receive the access defined by the managed permissions attached to the resource share.

      • The addition immediately appears in the Selected principals list.

        You can then add additional accounts, OUs, or your organization by repeating this step.

      • (Optional) To remove a principal, locate it under Selected principals, select its check box, and then choose Deselect.

10. Choose Next.

11. In Step 4: Review and update, review the configuration details for your resource share.

12. To change the configuration for any step, choose the link that corresponds to the step you want to go back to, and then make the required changes.

    If any managed permissions are still using versions other than the default, you have another opportunity to address that by choosing Update to default version.

13. Choose Update resource share when you're done making changes.