AWS Resource Access Manager – RAM

• AWS Resource Access Manager – RAM helps secure sharing of the AWS resources created in one AWS account with other AWS accounts.
• Using RAM, with multiple AWS accounts, a resource can be created once and made usable by those other accounts.
• For an account managed by AWS Organizations, resources can be shared with all the other accounts in the organization or only those accounts contained by one or more specified organizational units (OUs).
• Resources can also be shared with specific AWS accounts by account ID, regardless of whether the account is part of an organization.

RAM Benefits

• Reduces operational overhead
  • Create a resource once, and then use AWS RAM to share that resource with other accounts. This eliminates the need to provision duplicate resources in every account, which reduces operational overhead.
• Provides security and consistency
  • Simplify security management for the shared resources by using a single set of policies and permissions.
• Provides visibility and auditability
  • AWS RAM provides comprehensive visibility into shared resources and accounts through the integration with CloudWatch and CloudTrail.

RAM vs Resource-based Policies

• Resources can be shared with an Organization or OU without having to enumerate every one of the AWS account IDs.
• Users can see the resources shared with them directly in the originating AWS service console and API operations as if those resources were directly in the user’s account.
• Owners of a resource can see which principals have access to each individual resource that they have shared.
• RAM initiates an invitation process for resources shared with an account that isn’t part of the organization. Sharing within an organization doesn’t require an invitation and is auto-accepted.

RAM Supported Resources

References

AWS_Resource_Access_Manager