AWS Resource Access Manager (RAM)

AWS Resource Access Manager (RAM) lets one account share a resource it owns with other accounts, rather than every account creating its own copy. The owning account keeps ownership; the consuming account sees the resource in its own console and API responses as if it were local.

RAM itself is free. You pay only the normal charges for the underlying resource, billed to whichever account the owning service bills.

What can be shared

The list grows steadily, but the ones that come up most often are:

• VPC subnets (shared VPC)
• Transit Gateways and Transit Gateway route tables
• Route 53 Resolver rules and endpoints
• AWS Private CA certificate authorities
• AWS License Manager licence configurations
• EC2 Dedicated Hosts and Capacity Reservations
• AWS Network Firewall rule groups
• Aurora DB clusters (for cross-account cloning; RDS snapshot sharing is done through RDS itself, not RAM)

AWS maintains the authoritative list of shareable resources; check it rather than assuming a resource type is or is not supported.

Principals

A principal is whoever you share with. RAM accepts:

• Any AWS account, by account ID — including accounts outside your organization.
• An organization, or one or more organizational units, so you do not have to enumerate account IDs.
• Individual IAM roles and users, for the resource types that support it.

Sharing with an account outside your organization starts an invitation: the recipient must accept it in RAM before access begins. Sharing inside an organization requires no invitation, provided the management account has first turned on resource sharing with AWS Organizations.

A managed permission is attached to each resource type in the share. It sets the maximum the consuming account can do; administrators there still have to grant their own users access with IAM policies, and cannot exceed the share’s permission. Consuming accounts cannot delete or modify the shared resource itself.

Regions

A resource share is created in a Region, and:

• It can contain Regional resources only from that same Region.
• It can contain global resources only if the share lives in the designated home Region for global resources, US East (N. Virginia) us-east-1.

So global resources can be shared — the constraint is where the share is managed from, not whether cross-Region sharing exists at all. Consuming accounts access a Regional resource only from the Region it lives in, and a global resource from anywhere the owning service supports.

Where it earns its keep

Shared networking. One networking account owns the VPC, the subnets and the Transit Gateway; workload accounts launch into them. This replaces a mesh of VPC peering connections and keeps CIDR planning, route tables and network monitoring in one place.

Private certificate authorities. A private CA has a meaningful monthly cost and real operational weight. Sharing one across the organization avoids paying for and operating several.

DNS resolution. Route 53 Resolver rules shared from a networking account give every workload account the same view of on-premises and private DNS without per-account configuration.

Databases. Sharing an Aurora DB cluster supports cross-account cloning — a realistic test dataset without a copy job and without opening the production account.

Practices

1. Turn on sharing with AWS Organizations before you start, or every internal share will generate an invitation nobody expects.
2. Keep shares named after their purpose, not their contents, so the name survives the contents changing.
3. Review shares periodically. A share to an account that has since been closed or left the organization is easy to miss.
4. Watch the Region rule when accounts operate in different Regions — it is the most common cause of “the resource does not appear” reports.

AWS App Mesh

Older material lists App Mesh configurations among the things worth sharing through RAM. AWS App Mesh is being discontinued: after 30 September 2026 the console and its resources are no longer accessible, and it has taken no new customers since September 2024. AWS directs existing users to Amazon ECS Service Connect or Amazon VPC Lattice. Do not build a sharing model around it.