Skip to main content
This lesson covers AWS Resource Access Manager (RAM) — the service that makes it simple to share supported AWS resources across accounts and within your AWS Organization. By centralizing ownership of shared resources you avoid duplication, reduce costs, and simplify cross-account collaboration and management.
A slide titled "Resource Access Manager (RAM)" showing an "Organization" container split into four OUs (Development, Staging, Pre‑Prod, Production), each with a green bucket icon and an orange compute icon representing shared storage and compute resources.
What RAM lets you do
  • Share supported resources (for example, network components or managed lists) from a single owner account with other AWS accounts, OUs, or the entire AWS Organization.
  • Allow consuming accounts to use shared resources (for example, launch EC2 instances into a shared subnet, attach to a shared Transit Gateway, or reference a shared prefix list) without copying or recreating them.
  • Centralize management and tracking of resource access across your multi-account environment.
Common examples of shareable resources
Note: Not all AWS resources can be shared via RAM. For example, Amazon S3 buckets are not shared through RAM — use S3 bucket policies, cross-account IAM roles, or S3 Access Points for cross-account S3 access. Always consult the AWS RAM documentation for the current list of supported resource types.
Why use RAM?
  • Prevents resource fragmentation and duplication across accounts.
  • Reduces cost and operational overhead by centralizing ownership.
  • Simplifies access control by granting shares to account principals, OUs, or the entire AWS Organization.
  • Reduces the need for complex peering or multiple VPNs when using shared networking services like Transit Gateway.
Before RAM (historical challenges)
  • Fragmented resources across accounts led to poor utilization.
  • Duplicate resources were created in each account to enable cross-account access, increasing cost and maintenance.
  • Complex IAM, VPC peering, and network topologies made troubleshooting and management difficult.
  • No central, auditable way to track who had access to which resources.
How to use RAM — typical flow
  1. Create the resource in a central (owner) account.
  2. Create a resource share and select the resources to share.
  3. Choose principals (specific account IDs, Organizational Units, or the entire AWS Organization).
  4. If required, accept the resource share invitation in the recipient account.
  5. Monitor and manage the resource share from the AWS RAM console or via APIs/CLI.
A slide titled "How to Use AWS RAM" showing a four-step process with colorful icons: 01 Create a resource share, 02 Select resources to share, 03 Choose principals, and 04 Accept the resource share request at the receiving account. The steps are arranged in rounded panels across the slide.
Acceptance and Organization behavior
  • Shares to individual account IDs require the recipient account to accept the invitation.
  • Shares to your AWS Organization or to an OU can be configured to auto-enable for members (no manual acceptance needed) depending on your organization settings and share configuration.
  • Use organization-level shares where possible to reduce manual acceptance overhead.
Example AWS CLI usage Create a resource share (run in the owner account). Replace the ARN and principal with your values:
Accept a resource share invitation (run in the recipient account). Use the invitation ARN from the recipient’s console or API:
List resource shares (example — owner or self):
Practical tips and best practices
  • Verify the resource type is supported by RAM before designing your sharing strategy — see the AWS RAM documentation.
  • Apply least-privilege and principle-of-minimum-exposure: share only the resources required and monitor access.
  • Prefer sharing with the AWS Organization or OUs when possible to avoid per-account invitation acceptance.
  • Understand billing and operational implications — the owner account generally remains responsible for the resource.
  • For some resource types you may still need additional IAM permissions or resource-based policies even after creating a RAM share.
Summary
AWS Resource Access Manager (RAM) enables centralized ownership and secure cross-account sharing of supported AWS resources. Use RAM to reduce duplication, lower costs, and simplify management in multi-account environments — but always confirm support for the specific resource type and follow security best practices when granting access.

Watch Video