AWS Resource Access Manager
Browse all Amazonaws APIs★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthorizationhmac34 EndpointsREST
For Agents
Share AWS resources across accounts and organizations through resource shares, principal and resource associations, invitations, and customer managed permissions.
Use for: I need to share a Transit Gateway with another AWS account, Create a resource share for a list of subnet ARNs, Associate an entire Organizational Unit with an existing resource share, Accept a pending RAM invitation by ARN
Not supported: Does not provision the underlying resources, grant IAM permissions to users, or replicate data — use for cross-account and cross-organization sharing of existing AWS resources only.
Jentic publishes the only available OpenAPI specification for AWS Resource Access Manager (RAM), keeping it validated and agent-ready. RAM lets you share AWS resources across accounts and AWS Organizations: subnets, Transit Gateways, Route 53 Resolver rules, Capacity Reservations, License Manager configurations, and dozens more. The 34-operation API covers creating and updating resource shares, managing principal and resource associations, accepting or rejecting invitations, and authoring customer managed permissions. It is the control plane for centralized resource sharing in multi-account AWS estates.
Install Jentic One Beta
Connect the AWS Resource Access Manager to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Resource Access Manager, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with AWS Resource Access Manager API.
Create resource shares with resourceArns, principals, and attached permissions via CreateResourceShare
Associate or disassociate principals (account IDs, OUs, the entire org) with an existing resource share
Add or remove resource ARNs from an existing resource share without recreating it
Author and version customer managed permissions in JSON via CreatePermission and CreatePermissionVersion
Accept or reject pending resource share invitations from other AWS accounts
List shared resources, principals, and permissions visible to the calling account
Use Cases
Patterns agents use AWS Resource Access Manager API for, with concrete tasks.
★ Centralized VPC Subnet Sharing
Share VPC subnets from a network account to workload accounts so that EC2, RDS, and EKS resources in those accounts can be launched into shared subnets. CreateResourceShare with the subnet ARNs and the target accounts (or the entire AWS Organization) sets up the share, and AssociateResourceShare adds principals later. This eliminates per-account VPC duplication in landing-zone designs.
Call POST /createresourceshare with name 'shared-private-subnets', resourceArns of the subnet ARNs, principals as the target account IDs, and allowExternalPrincipals false
Org-Wide Transit Gateway Sharing
Share a Transit Gateway across an entire AWS Organization so every workload account can attach VPCs to it. AssociateResourceShare with the OrganizationArn (or specific OU ARNs) propagates access via the AWS service-managed permission. Pair with EnableSharingWithAwsOrganization to allow OU principals on shares.
Call POST /enablesharingwithawsorganization, then POST /associateresourceshare with the resource share ARN and principals containing the AWS Organization ARN
Custom Permissions for Shared Licenses
Limit what consumer accounts can do with shared resources by authoring customer managed permissions. CreatePermission and CreatePermissionVersion accept JSON policy documents that scope the actions allowed on the shared resource type, and AssociateResourceSharePermission attaches the permission to a share. Useful for shared License Manager configurations or shared Outpost capacity.
Call POST /createpermission with name 'license-read-only', resourceType 'license-manager:LicenseConfiguration', and a policy template restricting actions to ListAssociations and GetLicenseConfiguration
AI Agent Resource Sharing Tool via Jentic
A platform agent uses Jentic to discover RAM operations and automate sharing flows for new accounts joining the organization. Jentic stores AWS credentials in its vault and signs each call with SigV4, so the agent only handles the resource ARNs and target principals while landing-zone policies stay enforced.
Use Jentic to search 'create a resource share in aws ram', load CreateResourceShare, and execute it with the target resourceArns and principal account IDs
Key Endpoints
34 endpoints — jentic publishes the only available openapi specification for aws resource access manager (ram), keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
POST
/createresourceshare
Create a resource share with resourceArns, principals, and permissions
POST
/associateresourceshare
Add principals or resources to an existing resource share
POST
/disassociateresourceshare
Remove principals or resources from a share
POST
/acceptresourceshareinvitation
Accept a pending share invitation from another account
POST
/createpermission
Create a customer managed permission policy
POST
/enablesharingwithawsorganization
Enable RAM to use AWS Organizations as principals
POST
/createresourceshare
Create a resource share with resourceArns, principals, and permissions
POST
/associateresourceshare
Add principals or resources to an existing resource share
POST
/disassociateresourceshare
Remove principals or resources from a share
POST
/acceptresourceshareinvitation
Accept a pending share invitation from another account
POST
/createpermission
Create a customer managed permission policy
POST
/enablesharingwithawsorganization
Enable RAM to use AWS Organizations as principals
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
AWS access keys are stored encrypted in the Jentic vault. SigV4 signatures are computed per request, so agents never hold the raw secret access key.
Intent-based discovery
Agents search by intent (e.g., 'create a resource share in aws ram') and Jentic returns CreateResourceShare with its input schema for resourceArns, principals, and permissionArns.
Time to first call
Direct integration: 1-2 days for SDK setup, IAM scoping, and SigV4 signing across the 34-operation surface. Through Jentic: under 30 minutes for the common share-and-associate flow.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using AWS Resource Access Manager API through Jentic.
Why is there no official OpenAPI spec for AWS Resource Access Manager?
AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Access Manager via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the AWS RAM API use?
RAM uses AWS SigV4 HMAC request signing with an AWS access key ID and secret. Through Jentic, AWS credentials are stored in the vault and SigV4 signatures are produced per request, so the agent never sees raw secrets.
Can I share resources with an entire AWS Organization?
Yes. Call POST /enablesharingwithawsorganization once per management account, then pass the AWS Organization ARN or an OU ARN as a principal in CreateResourceShare or AssociateResourceShare. Without enableSharingWithAwsOrganization, only individual account IDs work as principals.
Which resource types can RAM share?
Supported types include VPC subnets, Transit Gateways, Route 53 Resolver rules and forwarding rules, License Manager configurations, AppMesh meshes, Capacity Reservations, Outposts, and dozens more. Call POST /listresourcetypes to retrieve the current list for your region.
What are the rate limits for the AWS RAM API?
RAM enforces account-level request quotas per region; throttled calls return ThrottlingException. AWS does not publish a fixed per-second number for every operation, so back off and retry on throttles, particularly on bulk Associate or Disassociate flows.
How do I create a resource share through Jentic?
Search Jentic for 'create a resource share in aws ram', load CreateResourceShare, and execute it with name, resourceArns, and principals. Install with pip install jentic; AWS credentials are pulled from the Jentic vault.
GET STARTED