RAM
AWS Resource Access Manager (RAM) lets one account share a resource with other accounts or with an entire organization. The AWS Baseline uses it for the two network resources every account must reach but only the network account owns: the Transit Gateway and the IPAM address pools.
What it does
A resource share names the resources, the principals (accounts, organizational units or the organization) and whether principals outside the organization are allowed. Once shared, the resource appears in the receiving account as if it were local, with the permissions the share grants. Sharing with an organization requires RAM to be enabled as a trusted service in AWS Organizations.
How BuiltForProd uses it
Transit Gateway. The transit-gateway unit in the network account uses the registry module terraform-aws-modules/transit-gateway/aws 3.3.1 with ram_principals set to the organization ARN and ram_allow_external_principals off. Every spoke account can then attach its VPC to the shared gateway, and enable_auto_accept_shared_attachments means those attachments need no manual acceptance. Routing stays in the network account: the gateway is created with default association and propagation disabled, and the transit-gateway-routes unit places each attachment in a route table for its isolation domain.
IPAM pools. The ipam module creates the pool hierarchy from the VPC map (organization, region, then one pool per OU) and shares the OU-level pools through the resource share acme-ipam-share, again to the organization only. A spoke VPC in a platform account allocates its CIDR from the shared plat pool, so no address is typed anywhere outside the map.
The organization side is prepared by the organizations module, which lists ram.amazonaws.com among the services with organization access. The deployment guide notes one manual step before IPAM can share: enabling RAM sharing with the organization in the management account.
Terms you will see
| Term | Meaning |
|---|---|
| Resource share | The RAM object that lists shared resources and their principals. |
| Principal | Who receives the share: an account, an OU or the organization. |
| External principals | Accounts outside the organization; disallowed in every platform share. |
| Trusted service | An AWS service enabled for organization-wide access in Organizations. |
| Shared attachment | A Transit Gateway attachment created by a spoke account against the shared gateway. |
Where to read more
- AWS Baseline overview
- Transit Gateway for the shared hub
- IPAM for the shared pools
- AWS Organizations for trusted-service access