ram-share

Creates AWS RAM resource shares that attach resource ARNs and principals to a share. Org-shared principals auto-accept, while non-Org principals require a separate ram-acceptance module invocation from the receiver account.

Custom permissions are attached via permission_arns, a direct attribute on the resource share — AWS RAM has no separate permission-association resource. When omitted, AWS auto-attaches its default managed permission for each resource type in the share. Custom permission ARNs (from aws_ram_permission or an AWS-managed permission) must be created elsewhere and passed in; this module does not create permissions.

Share names are derived as ${name_prefix}-${region_abbr}-${name_suffix}, matching the naming convention used across other modules.

Usage

module "ram_share" {
  source  = "hcassc.jfrog.io/iac-tf-modules-virtual__networking/ram-share/aws"
  version = "0.3.0"

  name_prefix = "acme-dev-shared"

  resource_shares = {
    example_share = {
      name_suffix   = "example-share"
      resource_arns = ["arn:aws:ec2:ap-south-1:123456789012:subnet/subnet-xxxx"]
      principals    = ["arn:aws:organizations::123456789012:organization/o-xxxxxxxxxx"]
    }
  }

  tags = local.stack_tags
}

Requirements

Name	Version
terraform	>= 1.15.0, < 2.0.0
aws	>= 6.0, < 7.0

Providers

Name	Version
aws	>= 6.0, < 7.0

Resources

Name	Type
aws_ram_principal_association.this	resource
aws_ram_resource_association.this	resource
aws_ram_resource_share.this	resource

Inputs

Name	Description	Type	Default	Required
name_prefix	Prefix prepended to resource names created by this module	string	n/a	yes
resource_shares	Map of RAM resource share definitions.resource_arns and principals are required to be explicitly passed into ensure deterministic, auditable sharing relationships.	map(object({ name_suffix = string resource_arns = list(string) principals = list(string) allow_external_principals = optional(bool, false) permission_arns = optional(list(string)) tags = optional(map(string), {}) }))	{}	no
tags	Tags applied to all resources in this module.	map(string)	{}	no

Outputs

Name	Description
principal_associations	Map of principal association keys to the associated principal.
resource_associations	Map of resource association keys to the associated resource ARN.
resource_share_arns	Map of resource share keys to RAM resource share ARNs.
resource_share_ids	Map of resource share keys to RAM resource share IDs.
resource_share_status	Map of resource share keys to their current status.