How AWS RAM works with IAM - AWS Resource Access Manager
Policy structure
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

How AWS RAM works with IAM

By default, IAM principals don't have permission to create or modify AWS RAM resources. To allow IAM principals to create or modify resources and perform tasks, you perform one of the following steps. These actions grant permission to use specific resources and API actions.

To provide access, add permissions to your users, groups, or roles:

AWS RAM provides several AWS managed policies that you can use that will address the needs of many users. For more information about these, see AWS managed policies for AWS Resource Access Manager.

If you need finer control over the permissions you grant to your users, you can construct your own policies in the IAM console. For information about creating policies and attaching them to your IAM roles and users, see Policies and permissions in IAM in the AWS Identity and Access Management User Guide.

The following sections provide the AWS RAM specific details for building an IAM permission policy.

Policy structure

An IAM permission policy is a JSON document that includes the following statements: Effect, Action, Resource, and Condition. An IAM policy typically takes the following form.

{
    "Statement":[{
        "Effect":"<effect>",
        "Action":"<action>",
        "Resource":"<arn>",
        "Condition":{
            "<comparison-operator>":{
                "<key>":"<value>"
            }
        }
    }]
}

Effect

The Effect statement indicates whether the policy allows or denies a principal permission to perform an action. The possible values include: Allow and Deny.

Action

The Action statement specifies the AWS RAM API actions for which the policy is allowing or denying permission. For a complete list of the allowed actions, see Actions defined by AWS Resource Access Manager in the IAM User Guide.

Resource

The Resource statement specifies the AWS RAM resources that are affected by the policy. To specify a resource in the statement, you need to use its unique Amazon Resource Name (ARN). For a complete list of the allowed resources, see Resources defined by AWS Resource Access Manager in the IAM User Guide.

Condition

Condition statements are optional. They can be used to further refine the conditions under which the policy applies. AWS RAM supports the following condition keys.

The multivalued keys ram:RequestedResourceArns, ram:RequestedResourceTypes, ram:RequestedPrincipals, ram:RequestedPermissionArns, and ram:RequestedPermissionResourceTypes contain the resources, principals, or managed permissions in the request. Use them with the ForAnyValue and ForAllValues set operators to evaluate the whole request in one condition. For examples, see Example IAM policies for AWS RAM.

  • aws:RequestTag/${TagKey} – Tests whether the service request includes a tag with the specified tag key exists and has the specified value.

  • aws:ResourceTag/${TagKey} – Tests whether the resource acted on by the service request has an attached tag with a tag key that you specify in the policy.

    The following example condition checks that the resource referenced in the service request has an attached tag with the key name "Owner" and a value of "Dev Team".

    "Condition" : { 
    "StringEquals" : {
        "aws:ResourceTag/Owner" : "Dev Team" 
    } 
}

  • aws:TagKeys – Specifies the tag keys that must be used to create or tag a resource share.

  • ram:AllowsExternalPrincipals – Tests whether the resource share in the service request allows sharing with external principals. An external principal is an AWS account outside of your organization in AWS Organizations. If this evaluates to False, then you can share this resource share with accounts only in the same organization.

  • ram:PermissionArn – Tests whether the permission ARN specified in the service request matches an ARN string that you specify in the policy.

    Note

    We recommend ram:RequestedPermissionArns instead. It contains the values of its kind in the request and works with the ForAnyValue and ForAllValues set operators, so one condition can authorize the whole request at once.

  • ram:PermissionResourceType – Tests whether the permission specified in the service request is valid for the resource type that you specify in the policy. Specify resource types using the format shown in the list of shareable resource types.

    Note

    We recommend ram:RequestedPermissionResourceTypes instead. It contains the values of its kind in the request and works with the ForAnyValue and ForAllValues set operators, so one condition can authorize the whole request at once.

  • ram:PermissionTemplateParameter/parameter-name – Tests the values that the request supplies for the named template parameter. This key is multivalued and is available on the permission resource for the CreateResourceShare, AssociateResourceSharePermission, and ReplacePermissionAssociations actions. For more information, see Control template parameter values with IAM policies.

  • ram:Principal – Tests whether the ARN of the principal specified in the service request matches an ARN string that you specify in the policy.

    Note

    We recommend ram:RequestedPrincipals instead. It contains the values of its kind in the request and works with the ForAnyValue and ForAllValues set operators, so one condition can authorize the whole request at once.

  • ram:RequestedAllowsExternalPrincipals – Tests whether the service request includes the allowExternalPrincipals parameter and whether its argument matches the value you specify in the policy.

  • ram:RequestedPermissionArns – Tests the ARNs of the managed permissions in the request. This key is multivalued. It is available on CreateResourceShare, AssociateResourceShare, the actions that create, change, associate, or disassociate managed permissions, GetPermission, and ListPermissionAssociations. Note the following:

    • For CreateResourceShare, it contains the managed permissions that you specify and the default AWS managed permission for each resource type that you don't specify a managed permission for.

    • For AssociateResourceShare, it contains the default AWS managed permissions that AWS RAM adds for new resource types. If the resource share already covers every resource type in the request, the key isn't present.

    • For ReplacePermissionAssociations, it contains only the managed permission that you replace with.

    • For ListPermissionAssociations, it is present only when the request specifies a permission ARN.

  • ram:RequestedPermissionResourceTypes – Tests the resource types of the managed permissions in the request. This key is multivalued and is available on the same actions as ram:RequestedPermissionArns.

  • ram:RequestedPrincipals – Tests all of the principals specified in the request. This key is multivalued and is available on the CreateResourceShare, AssociateResourceShare, and DisassociateResourceShare actions.

  • ram:RequestedResourceArns – Tests the ARNs of all of the resources specified in the request. This key is multivalued and is available on the CreateResourceShare, AssociateResourceShare, and DisassociateResourceShare actions.

  • ram:RequestedResourceType – Tests whether the resource type of the resource being acted on matches a resource type string that you specify in the policy. Specify resource types using the format shown in the list of shareable resource types.

    Note

    We recommend ram:RequestedResourceTypes instead. It contains the values of its kind in the request and works with the ForAnyValue and ForAllValues set operators, so one condition can authorize the whole request at once.

  • ram:RequestedResourceTypes – Tests the resource types of all of the resources specified in the request. This key is multivalued and is available on the CreateResourceShare, AssociateResourceShare, and DisassociateResourceShare actions.

  • ram:ResourceArn – Tests whether the ARN of the resource being acted upon by the service request matches an ARN that you specify in the policy.

    Note

    We recommend ram:RequestedResourceArns instead. It contains the values of its kind in the request and works with the ForAnyValue and ForAllValues set operators, so one condition can authorize the whole request at once.

  • ram:ResourceShareName – Tests whether the name of the resource share being acted upon by the service request matches a string that you specify in the policy.

  • ram:ShareOwnerAccountId – Tests the account ID number of the resource share being acted upon by the service request matches a string that you specify in the policy.