AWS Resource Access Manager
While AWS Organizations is the framework for managing different AWS accounts, AWS Resource Access Manager (RAM) is the tool that allows the sharing of AWS resources between accounts inside or outside of an organization. Not every resource in AWS is shareable between accounts, even if they belong to the same organization, and this chapter will focus on the network resources that can be shared in this manner.
Note
AWS RAM does not work with AWS Organizations by default. The setting must be enabled in the AWS RAM console under Settings
.
Resource Sharing
The act of sharing resources using AWS RAM involves three objects: the resource to be shared, the principal to which the resource share will be granted, and the permissions applied to the share, which determines what the principal can do within the share.
Note that RAM works with or without AWS Organizations! RAM allows any AWS account to share resources with other AWS accounts. The main benefit...