AWS Resource Access Manager (RAM)
AWS Resource Access Manager (RAM) is an Amazon Web Services service that allows resources to be shared through AWS Organizations or across separate AWS accounts, reducing the need to create duplicate resources in each account.
Key points
- Controls the consumption of shared resources using existing policies and permissions.
- Can be integrated with Amazon Cloudwatch and Amazon Cloudtrail to provide detailed visibility into shared resources and accounts.
- Access control policies in AWS Identity and Access Management (IAM) and Service Control Policies in AWS Organizations provide security and governance controls for AWS RAM.
- Example: a subnet (and its EC2 instance) owned by one AWS account can be made available for use in a second AWS account, without duplicating the underlying resource.
- Distinct from AWS Control Tower, which sets up and governs a multi-account landing zone, rather than sharing individual resources between accounts.
- Only shares existing AWS resources across accounts — it is not used to purchase or license third-party software (that’s AWS Marketplace and AWS License Manager).
- Shareable resource types now span dozens of services well beyond simple networking primitives, including Amazon Aurora and Amazon RDS resources, Amazon S3 on Outposts, AWS License Manager configurations, Amazon SageMaker AI resources, and AWS Systems Manager Incident Manager response plans.
- Resource share / principal / permission model — a resource share is the unit of sharing: it names the specific resources being shared, the principals allowed to use them (individual AWS accounts, an OU, or an entire AWS Organization), and a RAM managed permission attached per resource type that caps what those principals can do with the shared resource.
- Sharing within an AWS Organization — once sharing is turned on for the Organization, resources shared with member accounts or OUs are available immediately; no invitation or acceptance step is required because AWS already trusts the relationship between accounts in the same Organization.
- Invitation-based sharing — sharing with a specific AWS account ID that is not part of the sharer’s Organization triggers an invitation; the recipient account must explicitly accept it before it can access the shared resources.
- Commonly shared resource types on the exam include subnets, AWS Transit Gateway attachments, Route 53 Resolver rules, and AWS License Manager configurations — in every case the owning account keeps the resource, and other accounts merely get permission to use it.
Pricing
- AWS RAM itself is free — there is no charge for creating resource shares or for the sharing feature. You pay only the normal usage charges for the underlying shared resource, billed as if it were used directly in the owning account.