canonical: https://jentic.com/apis/amazonaws.com/ram # AWS Resource Access Manager Jentic publishes the only available OpenAPI specification for AWS Resource Access Manager (RAM), keeping it validated and agent-ready. RAM lets you share AWS resources across accounts and AWS Organizations: subnets, Transit Gateways, Route 53 Resolver rules, Capacity Reservations, License Manager configurations, and dozens more. The 34-operation API covers creating and updating resource shares, managing principal and resource associations, accepting or rejecting invitations, and authoring customer managed permissions. It is the control plane for centralized resource sharing in multi-account AWS estates. ## For AI agents Share AWS resources across accounts and organizations through resource shares, principal and resource associations, invitations, and customer managed permissions. ## Scope Does not provision the underlying resources, grant IAM permissions to users, or replicate data - use for cross-account and cross-organization sharing of existing AWS resources only. ## Capabilities - Create resource shares with resourceArns, principals, and attached permissions via CreateResourceShare - Associate or disassociate principals (account IDs, OUs, the entire org) with an existing resource share - Add or remove resource ARNs from an existing resource share without recreating it - Author and version customer managed permissions in JSON via CreatePermission and CreatePermissionVersion - Accept or reject pending resource share invitations from other AWS accounts - List shared resources, principals, and permissions visible to the calling account ## Use cases ### Centralized VPC Subnet Sharing Share VPC subnets from a network account to workload accounts so that EC2, RDS, and EKS resources in those accounts can be launched into shared subnets. CreateResourceShare with the subnet ARNs and the target accounts (or the entire AWS Organization) sets up the share, and AssociateResourceShare adds principals later. This eliminates per-account VPC duplication in landing-zone designs. Example prompt: Call POST /createresourceshare with name 'shared-private-subnets', resourceArns of the subnet ARNs, principals as the target account IDs, and allowExternalPrincipals false ### Org-Wide Transit Gateway Sharing Share a Transit Gateway across an entire AWS Organization so every workload account can attach VPCs to it. AssociateResourceShare with the OrganizationArn (or specific OU ARNs) propagates access via the AWS service-managed permission. Pair with EnableSharingWithAwsOrganization to allow OU principals on shares. Example prompt: Call POST /enablesharingwithawsorganization, then POST /associateresourceshare with the resource share ARN and principals containing the AWS Organization ARN ### Custom Permissions for Shared Licenses Limit what consumer accounts can do with shared resources by authoring customer managed permissions. CreatePermission and CreatePermissionVersion accept JSON policy documents that scope the actions allowed on the shared resource type, and AssociateResourceSharePermission attaches the permission to a share. Useful for shared License Manager configurations or shared Outpost capacity. Example prompt: Call POST /createpermission with name 'license-read-only', resourceType 'license-manager:LicenseConfiguration', and a policy template restricting actions to ListAssociations and GetLicenseConfiguration ### AI Agent Resource Sharing Tool via Jentic A platform agent uses Jentic to discover RAM operations and automate sharing flows for new accounts joining the organization. Jentic stores AWS credentials in its vault and signs each call with SigV4, so the agent only handles the resource ARNs and target principals while landing-zone policies stay enforced. Example prompt: Use Jentic to search 'create a resource share in aws ram', load CreateResourceShare, and execute it with the target resourceArns and principal account IDs ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /createresourceshare | Create a resource share with resourceArns, principals, and permissions | | POST | /associateresourceshare | Add principals or resources to an existing resource share | | POST | /disassociateresourceshare | Remove principals or resources from a share | | POST | /acceptresourceshareinvitation | Accept a pending share invitation from another account | | POST | /createpermission | Create a customer managed permission policy | | POST | /enablesharingwithawsorganization | Enable RAM to use AWS Organizations as principals | ## Key resources - **ResourceShare** — Top-level container that holds resourceArns, principals, and attached permissions - **ResourceShareInvitation** — Cross-account invitations that must be accepted or rejected - **Principal** — Account, OU, or organization principal associated with a share - **Permission** — AWS-managed and customer managed permission documents - **PermissionVersion** — Versioned permission documents that can be set as default - **Resource** — Resource ARNs currently associated with a share ## Why Jentic - **Setup:** Wiring Resource Access Manager by hand means computing SigV4 HMAC signatures per request, routing to the correct regional ram host, and stitching together the create-share, associate, and invitation-acceptance flow across its many operations yourself. Through Jentic you install once, import AWS Resource Access Manager from the API Directory, store your AWS access keys once, and your agent calls it with signing done per request. - **Permission scoping:** The resource share, principals, and permissions travel in the request body rather than the URL path, so you limit the agent to the operations it needs, such as CreateResourceShare and AssociateResourceShare. Destructive operations like DeleteResourceShare or DisassociateResourceShare are not included unless you add them. - **Credential handling:** Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to produce a SigV4 signature per request. The raw secret access key never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create a resource share in AWS RAM', and Jentic returns CreateResourceShare with its input schema for resourceArns, principals, and permissionArns so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **AWS Security Token Service** — STS hands out cross-account temporary credentials; RAM shares the underlying resources directly - **AWS AppSync** — Share AppSync data sources or related resources via RAM as part of multi-account API platforms - **AWS Audit Manager** — Audit which RAM shares exist across an organization and the principals they expose ## FAQ ### Why is there no official OpenAPI spec for AWS Resource Access Manager? AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Access Manager via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the AWS RAM API use? RAM uses AWS SigV4 HMAC request signing with an AWS access key ID and secret. Through Jentic, AWS credentials are stored in the vault and SigV4 signatures are produced per request, so the agent never sees raw secrets. ### Can I share resources with an entire AWS Organization? Yes. Call POST /enablesharingwithawsorganization once per management account, then pass the AWS Organization ARN or an OU ARN as a principal in CreateResourceShare or AssociateResourceShare. Without enableSharingWithAwsOrganization, only individual account IDs work as principals. ### Which resource types can RAM share? Supported types include VPC subnets, Transit Gateways, Route 53 Resolver rules and forwarding rules, License Manager configurations, AppMesh meshes, Capacity Reservations, Outposts, and dozens more. Call POST /listresourcetypes to retrieve the current list for your region. ### What are the rate limits for the AWS RAM API? RAM enforces account-level request quotas per region; throttled calls return ThrottlingException. AWS does not publish a fixed per-second number for every operation, so back off and retry on throttles, particularly on bulk Associate or Disassociate flows. ### How do I create a resource share through Jentic? Search Jentic for 'create a resource share in aws ram', load CreateResourceShare, and execute it with name, resourceArns, and principals. Install with pip install jentic; AWS credentials are pulled from your Jentic One instance. ### Can I limit what my agent is allowed to do with the AWS RAM API? Yes. Because Jentic One is self-hosted, you decide which RAM operations the agent may call and which AWS credentials it uses, so you can allow only the ones it needs, such as CreateResourceShare and AssociateResourceShare. The resource share, principals, and permissions travel in the request body rather than the URL path, so scoping happens at the operation level rather than by path. Destructive operations like DeleteResourceShare and DisassociateResourceShare stay out of reach unless you explicitly add them.