AWS Resource Access Manager

Name: AWS Resource Access Manager API
Brand: AWS Resource Access Manager
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthorizationhmac34 EndpointsREST

For Agents

Share AWS resources across accounts and organizations through resource shares, principal and resource associations, invitations, and customer managed permissions.

Connect the AWS Resource Access Manager to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Resource Access Manager, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AWS Resource Access Manager API.

Create resource shares with resourceArns, principals, and attached permissions via CreateResourceShare

Associate or disassociate principals (account IDs, OUs, the entire org) with an existing resource share

Add or remove resource ARNs from an existing resource share without recreating it

Author and version customer managed permissions in JSON via CreatePermission and CreatePermissionVersion

GET STARTED

Start building with AWS Resource Access Manager API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI document for AWS Resource Access Manager, keeping it validated and agent-ready.

Jentic publishes the only available OpenAPI specification for AWS Resource Access Manager (RAM), keeping it validated and agent-ready. RAM lets you share AWS resources across accounts and AWS Organizations: subnets, Transit Gateways, Route 53 Resolver rules, Capacity Reservations, License Manager configurations, and dozens more. The 34-operation API covers creating and updating resource shares, managing principal and resource associations, accepting or rejecting invitations, and authoring customer managed permissions. It is the control plane for centralized resource sharing in multi-account AWS estates.

Use Cases

Patterns agents use AWS Resource Access Manager API for, with concrete tasks.

★ Centralized VPC Subnet Sharing

Share VPC subnets from a network account to workload accounts so that EC2, RDS, and EKS resources in those accounts can be launched into shared subnets. CreateResourceShare with the subnet ARNs and the target accounts (or the entire AWS Organization) sets up the share, and AssociateResourceShare adds principals later. This eliminates per-account VPC duplication in landing-zone designs.

Call POST /createresourceshare with name 'shared-private-subnets', resourceArns of the subnet ARNs, principals as the target account IDs, and allowExternalPrincipals false

Org-Wide Transit Gateway Sharing

Share a Transit Gateway across an entire AWS Organization so every workload account can attach VPCs to it. AssociateResourceShare with the OrganizationArn (or specific OU ARNs) propagates access via the AWS service-managed permission. Pair with EnableSharingWithAwsOrganization to allow OU principals on shares.

Call POST /enablesharingwithawsorganization, then POST /associateresourceshare with the resource share ARN and principals containing the AWS Organization ARN

Custom Permissions for Shared Licenses

Limit what consumer accounts can do with shared resources by authoring customer managed permissions. CreatePermission and CreatePermissionVersion accept JSON policy documents that scope the actions allowed on the shared resource type, and AssociateResourceSharePermission attaches the permission to a share. Useful for shared License Manager configurations or shared Outpost capacity.

Call POST /createpermission with name 'license-read-only', resourceType 'license-manager:LicenseConfiguration', and a policy template restricting actions to ListAssociations and GetLicenseConfiguration

AI Agent Resource Sharing Tool via Jentic

A platform agent uses Jentic to discover RAM operations and automate sharing flows for new accounts joining the organization. Jentic stores AWS credentials in its vault and signs each call with SigV4, so the agent only handles the resource ARNs and target principals while landing-zone policies stay enforced.

Use Jentic to search 'create a resource share in aws ram', load CreateResourceShare, and execute it with the target resourceArns and principal account IDs

Key Endpoints

34 endpoints — jentic publishes the only available openapi specification for aws resource access manager (ram), keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/createresourceshare

Create a resource share with resourceArns, principals, and permissions

POST

/associateresourceshare

Add principals or resources to an existing resource share

POST

/disassociateresourceshare

Remove principals or resources from a share

POST

/acceptresourceshareinvitation

Accept a pending share invitation from another account

POST

/createpermission

Create a customer managed permission policy

POST

/enablesharingwithawsorganization

Enable RAM to use AWS Organizations as principals

POST

/createresourceshare

Create a resource share with resourceArns, principals, and permissions

POST

/associateresourceshare

Add principals or resources to an existing resource share

POST

/disassociateresourceshare

Remove principals or resources from a share

POST

/acceptresourceshareinvitation

Accept a pending share invitation from another account

POST

/createpermission

Create a customer managed permission policy

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

AWS access keys are stored encrypted in the Jentic vault. SigV4 signatures are computed per request, so agents never hold the raw secret access key.

Intent-based discovery

Agents search by intent (e.g., 'create a resource share in aws ram') and Jentic returns CreateResourceShare with its input schema for resourceArns, principals, and permissionArns.

Time to first call

Direct integration: 1-2 days for SDK setup, IAM scoping, and SigV4 signing across the 34-operation surface. Through Jentic: under 30 minutes for the common share-and-associate flow.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Alternative

AWS Security Token Service

STS hands out cross-account temporary credentials; RAM shares the underlying resources directly

Use STS when an account needs to assume a role to act in another account; use RAM when the goal is to expose specific resources (subnets, TGWs) to other accounts in place.

Complementary

AWS AppSync

Share AppSync data sources or related resources via RAM as part of multi-account API platforms

Use AppSync to build the GraphQL surface and RAM to share the supporting infrastructure (e.g. shared VPC subnets) it depends on.

Complementary

AWS Audit Manager

Audit which RAM shares exist across an organization and the principals they expose

Use Audit Manager when an agent needs to assess compliance posture of cross-account sharing established via RAM.

FAQs

Specific to using AWS Resource Access Manager API through Jentic.

Why is there no official OpenAPI spec for AWS Resource Access Manager?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Access Manager via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the AWS RAM API use?

RAM uses AWS SigV4 HMAC request signing with an AWS access key ID and secret. Through Jentic, AWS credentials are stored in the vault and SigV4 signatures are produced per request, so the agent never sees raw secrets.

Can I share resources with an entire AWS Organization?

Yes. Call POST /enablesharingwithawsorganization once per management account, then pass the AWS Organization ARN or an OU ARN as a principal in CreateResourceShare or AssociateResourceShare. Without enableSharingWithAwsOrganization, only individual account IDs work as principals.

Which resource types can RAM share?

Supported types include VPC subnets, Transit Gateways, Route 53 Resolver rules and forwarding rules, License Manager configurations, AppMesh meshes, Capacity Reservations, Outposts, and dozens more. Call POST /listresourcetypes to retrieve the current list for your region.

What are the rate limits for the AWS RAM API?

RAM enforces account-level request quotas per region; throttled calls return ThrottlingException. AWS does not publish a fixed per-second number for every operation, so back off and retry on throttles, particularly on bulk Associate or Disassociate flows.

How do I create a resource share through Jentic?

Search Jentic for 'create a resource share in aws ram', load CreateResourceShare, and execute it with name, resourceArns, and principals. Install with pip install jentic; AWS credentials are pulled from the Jentic vault.