AWS Resource Access Manager (RAM) – SAP-C02 Study Guide

Purpose of This Lesson

AWS Resource Access Manager (AWS RAM) lets you share supported AWS resources across AWS accounts and organizational structures without duplicating those resources in every account. It is especially useful in multi-account environments managed with AWS Organizations.

This guide covers what AWS RAM does, who can receive shared resources, how resource shares are created, and the design decisions commonly tested in AWS certification scenarios.

Key Concepts

What AWS RAM does

AWS RAM creates resource shares that make selected AWS resources available to other authorized accounts or principals. Sharing is performed through:

• The AWS RAM console
• AWS RAM APIs
• The AWS Command Line Interface (AWS CLI)
• AWS SDKs for programmatic automation

The resource remains an AWS resource managed through its native service, while AWS RAM controls which accounts or principals can access the shared resource.

Sharing across accounts and organizations

AWS RAM can be used to share resources:

• Between AWS accounts
• With accounts or organizational units (OUs) in an AWS Organization
• With selected IAM users or IAM roles for resource types that support that sharing model

Sharing with an OU is useful when multiple accounts need access to a common resource and those accounts are governed by the same organizational structure.

Supported resources

AWS RAM supports specific AWS resource types rather than every resource in an account. The supported list is service- and resource-specific.

Examples include selected Amazon VPC resources such as:

• Subnets
• Transit gateways

Other services and resource types may also be supported. Before designing a solution, verify that the exact resource type can be shared and identify any service-specific conditions.

Resource shares

A resource share identifies the resources being shared and the accounts, OUs, or supported IAM principals that can use them. Creating a share does not mean that all AWS resources automatically become available to another account.

The sharing model is therefore based on explicit selection:

1. Select a supported resource.
2. Create a resource share.
3. Specify the intended accounts, OUs, or supported IAM principals.
4. Manage access through the relevant resource and identity permissions.

Architecture Decision Guide

Requirement	AWS RAM decision	Important consideration
Make a supported resource available to another AWS account	Create a resource share	Confirm that the resource type supports RAM sharing
Share with several accounts managed under AWS Organizations	Share with the appropriate organization or OU	Ensure the intended accounts are included in the organizational structure
Provide access to a specific IAM role or user	Use IAM-principal sharing when supported	This is available only for selected resource types and sharing models
Share VPC connectivity or network infrastructure	Check supported Amazon VPC resources, such as subnets or transit gateways	Validate the exact resource type and its service-specific behavior
Automate resource sharing	Use RAM APIs, AWS CLI, or an AWS SDK	Treat resource shares as infrastructure that should be documented and governed
Share a resource not listed as RAM-supported	Do not assume RAM can be used	Consider the resource service’s native cross-account access model instead

Exam-Relevant Takeaways

• AWS RAM is a resource-sharing service, not a general-purpose replacement for IAM.
• RAM supports sharing across AWS accounts and, in AWS Organizations, with organizational units.
• Some supported resource types can also be shared with IAM users or IAM roles.
• Sharing is limited to supported resource types. Always verify the resource-specific support matrix.
• Amazon VPC examples include sharing subnets and transit gateways.
• Resource shares can be created from the console, APIs, AWS CLI, or SDKs.
• An AWS Organization or OU is a possible sharing target; it is not necessary to create separate copies of a resource for each account when RAM sharing is supported.

Common Exam Traps

Assuming every AWS resource can be shared

RAM has a defined list of supported resource types. If a scenario involves an unsupported resource, RAM is not automatically the answer.

Confusing resource sharing with IAM permissions

RAM determines which accounts or supported principals receive access to a shared resource. IAM still matters for identity permissions, and the native AWS service may impose additional rules.

Treating an OU as an individual user or role

An OU is an AWS Organizations grouping used to target accounts. It is different from an IAM user or role. The appropriate target depends on the required sharing scope.

Assuming cross-account sharing always means public access

A RAM resource share is intended for specified accounts, organizational targets, or supported principals. It is not the same as making a resource publicly accessible.

Ignoring resource-specific behavior

The fact that one Amazon VPC resource supports RAM does not prove that every VPC-related resource does. Check the exact resource type before selecting RAM in an exam scenario or production design.

Real-World Engineer Notes

• Use AWS Organizations and OUs to express broad, governed sharing boundaries when multiple accounts have a common requirement.
• Prefer the narrowest practical sharing scope. A specific account or role may be more appropriate than an entire OU when access requirements are limited.
• Document which account owns the resource and which accounts consume it. Shared ownership and operational responsibility are not necessarily the same thing.
• Automate RAM resource shares with infrastructure-as-code or the AWS SDK where repeatability and auditability matter.
• Include the RAM-supported resource list in design reviews. Service support can vary by resource type and may change over time.
• For network designs, evaluate shared subnets and transit gateways as part of the overall account and VPC architecture rather than treating RAM as an isolated security control.

Quick Reference Summary

• Service: AWS Resource Access Manager (AWS RAM)
• Primary purpose: Share supported AWS resources across accounts and organizational structures
• Possible targets: AWS accounts, AWS Organizations OUs, and selected IAM users or roles
• Example resources: Amazon VPC subnets and transit gateways
• Management methods: Console, APIs, AWS CLI, and SDKs
• Critical limitation: Only supported resource types can be shared
• Design principle: Verify the exact resource type and choose the narrowest appropriate sharing scope

Flashcards

1. Q: What is the primary purpose of AWS RAM?

A: To share supported AWS resources across AWS accounts and organizational structures.

1. Q: What is the object created by AWS RAM to define a sharing arrangement?

A: A resource share.

1. Q: Can AWS RAM share resources between AWS accounts?

A: Yes, when the resource type is supported.

1. Q: Can AWS RAM target an organizational unit?

A: Yes. A resource share can target accounts or OUs in AWS Organizations.

1. Q: Can RAM share resources with IAM users and roles?

A: Yes, for selected resource types and supported sharing models.

1. Q: Does AWS RAM support every AWS resource?

A: No. RAM supports a defined set of resource types.

1. Q: Name two Amazon VPC resources that can be shared through RAM.

A: Subnets and transit gateways.

1. Q: Which tools can create RAM resource shares?

A: The AWS RAM console, RAM APIs, AWS CLI, and AWS SDKs.

1. Q: Is AWS RAM a replacement for IAM?

A: No. RAM establishes resource-sharing relationships; identity and service permissions still apply.

1. Q: What should you verify before choosing RAM for a design?

A: Whether the exact resource type supports RAM and what sharing targets it permits.

Practice Questions

Question 1

A company uses multiple AWS accounts organized into OUs. A centrally managed network resource must be made available to accounts in one OU without creating a separate copy in every account. Which service should the architect evaluate first?

• A. AWS Resource Access Manager
• B. AWS Identity and Access Management
• C. AWS Resource Groups only
• D. Amazon Cognito

Correct answer: A. AWS Resource Access Manager

Explanation: AWS RAM is designed to share supported resources across accounts and with OUs in AWS Organizations. IAM alone does not provide the resource-sharing mechanism.

Question 2

An architect wants to share an AWS resource with another account but discovers that the exact resource type is not listed among AWS RAM-supported resources. What is the best conclusion?

• A. RAM will share it automatically if the accounts are in the same Organization.
• B. RAM should not be assumed to support it; the service’s native cross-account mechanism must be investigated.
• C. The resource must be made public.
• D. An IAM group must be created in the owning account.

Correct answer: B. RAM should not be assumed to support it; the service’s native cross-account mechanism must be investigated.

Explanation: AWS RAM supports specific resource types. Organizational membership does not make every resource shareable through RAM.

Question 3

A network team needs to make a centrally managed subnet available to workloads in other AWS accounts. Which AWS service is most directly associated with this requirement?

• A. AWS Resource Access Manager
• B. AWS Config
• C. AWS Secrets Manager
• D. Amazon Route 53 Resolver only

Correct answer: A. AWS Resource Access Manager

Explanation: Subnets are an example of an Amazon VPC resource that can be shared through AWS RAM, subject to the applicable support and configuration requirements.

Question 4

An organization wants to automate the creation of resource shares as part of its deployment pipeline. Which approach is supported?

• A. Use only the AWS Management Console.
• B. Use RAM APIs, the AWS CLI, or an AWS SDK.
• C. Use an IAM password policy.
• D. Use an Amazon CloudFront distribution.

Correct answer: B. Use RAM APIs, the AWS CLI, or an AWS SDK.

Explanation: AWS RAM resource shares can be managed through the console, APIs, CLI, and SDKs, making automation possible.

Question 5

A team creates an AWS RAM resource share for a supported resource and targets an IAM role. Which statement is most accurate?

• A. All resources in the account become available to the role.
• B. The role can use the selected shared resource, subject to the supported sharing model and applicable permissions.
• C. The role gains administrator access to the owning account.
• D. The resource becomes publicly accessible.

Correct answer: B. The role can use the selected shared resource, subject to the supported sharing model and applicable permissions.

Explanation: RAM shares selected resources with specified supported principals. It does not expose all account resources, grant account-wide administrator access, or make the resource public.