Terraform AWS RAM (Resource Access Manager)

Description

The purpose of this module is to provide a building block for using AWS RAM (Resource Access Manager) to share (supported) AWS Resources across multiple accounts .

Usage

See examples for use cases

module "ram_ssm_param" {
  source  = "appvia/ram/aws"
  version = "0.0.1"

  name = "share-ssm-parameter-within-org"

  # Resource ARN for the SSM parameter to share
  resource_arns = [
    "arn:aws:ssm:eu-west-2:123456789101:parameter/something_important"
  ]

  # Organization principal ARN
  principals = [
    "arn:aws:organizations::101987654321:organization/o-abcdef1234"
  ]

  # Since we're sharing within org, keep external principals disabled
  allow_external_principals = false

  tags = {
    Purpose = "SSM Parameter Sharing"
    Scope   = "Organization"
  }
}

Update Documentation

The terraform-docs utility is used to generate this README. Follow the below steps to update:

1. Make changes to the .terraform-docs.yml file
2. Fetch the terraform-docs binary (https://terraform-docs.io/user-guide/installation/)
3. Run terraform-docs markdown table --output-file ${PWD}/README.md --output-mode inject .

Providers

Name	Version
aws	>= 5.0.0

Inputs

Name	Description	Type	Default	Required
name	The name of the resource share	string	n/a	yes
principals	The principals to associate with the resource share. Possible values are an AWS account ID, an AWS Organizations Organization ARN, or an AWS Organizations Organization Unit ARN.	list(string)	n/a	yes
resource_arns	List of Amazon Resource Names (ARNs) of the resources to associate with the RAM share.	list(string)	n/a	yes
allow_external_principals	Indicates whether principals outside your organization can be associated with a resource share. Default is false for security best practices.	bool	false	no
permission_arns	Specifies the Amazon Resource Names (ARNs) of the RAM permissions to associate with the resource share. If not specified, RAM automatically attaches the default version of the permission for each resource type. Only one permission can be associated with each resource type included in the resource share.	list(string)	[]	no
tags	Key-value map of tags to assign to the RAM share resource.	map(string)	{}	no

Outputs

Name	Description
accepter_status	Status of the resource share accepter
resource_association_arns	ARNs of the resource associations
resource_share_arn	ARN of the resource share