AWS.RAM reference

AcceptResourceShareInvitation

Source: src/AWS/RAM/AcceptResourceShareInvitation.ts

Runtime binding for ram:AcceptResourceShareInvitation.

Accepts an invitation to a resource share from another account, granting this account access to the shared resources. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.AcceptResourceShareInvitationHttp).

AcceptResourceShareInvitation: Invitations

// init — account-level binding, no resource argument
const acceptResourceShareInvitation = yield* AWS.RAM.AcceptResourceShareInvitation();

// runtime
const { resourceShareInvitation } =
  yield* acceptResourceShareInvitation({
    resourceShareInvitationArn: invitationArn,
  });

GetPermission

Source: src/AWS/RAM/GetPermission.ts

Runtime binding for ram:GetPermission.

Retrieves the contents of a managed permission in JSON format, including its policy template. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.GetPermissionHttp).

GetPermission: Managed Permissions

// init — account-level binding, no resource argument
const getPermission = yield* AWS.RAM.GetPermission();

// runtime
const { permission } = yield* getPermission({
  permissionArn: customerManagedPermission.permissionArn,
});

GetResourcePolicies

Source: src/AWS/RAM/GetResourcePolicies.ts

Runtime binding for ram:GetResourcePolicies.

Retrieves the RAM-generated resource policies attached to resources that you own and have shared. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.GetResourcePoliciesHttp).

GetResourcePolicies: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const getResourcePolicies = yield* AWS.RAM.GetResourcePolicies();

// runtime
const { policies } = yield* getResourcePolicies({
  resourceArns: [subnetArn],
});

GetResourceShareAssociations

Source: src/AWS/RAM/GetResourceShareAssociations.ts

Runtime binding for ram:GetResourceShareAssociations.

Retrieves the principal and resource associations of your resource shares — who has access, and to what. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.GetResourceShareAssociationsHttp).

GetResourceShareAssociations: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const getResourceShareAssociations = yield* AWS.RAM.GetResourceShareAssociations();

// runtime
const { resourceShareAssociations } =
  yield* getResourceShareAssociations({ associationType: "PRINCIPAL" });

GetResourceShareInvitations

Source: src/AWS/RAM/GetResourceShareInvitations.ts

Runtime binding for ram:GetResourceShareInvitations.

Retrieves the invitations to resource shares that other accounts extended to you. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.GetResourceShareInvitationsHttp).

GetResourceShareInvitations: Invitations

// init — account-level binding, no resource argument
const getResourceShareInvitations = yield* AWS.RAM.GetResourceShareInvitations();

// runtime
const { resourceShareInvitations } =
  yield* getResourceShareInvitations();

GetResourceShares

Source: src/AWS/RAM/GetResourceShares.ts

Runtime binding for ram:GetResourceShares.

Retrieves details about the resource shares that you own (resourceOwner: "SELF") or that are shared with you (resourceOwner: "OTHER-ACCOUNTS"). Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.GetResourceSharesHttp).

GetResourceShares: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const getResourceShares = yield* AWS.RAM.GetResourceShares();

// runtime
const { resourceShares } = yield* getResourceShares({
  resourceOwner: "SELF",
});

ListPendingInvitationResources

Source: src/AWS/RAM/ListPendingInvitationResources.ts

Runtime binding for ram:ListPendingInvitationResources.

Lists the resources inside a resource share whose invitation to you is still pending. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListPendingInvitationResourcesHttp).

ListPendingInvitationResources: Invitations

// init — account-level binding, no resource argument
const listPendingInvitationResources = yield* AWS.RAM.ListPendingInvitationResources();

// runtime
const { resources } = yield* listPendingInvitationResources({
  resourceShareInvitationArn: invitationArn,
});

ListPermissionAssociations

Source: src/AWS/RAM/ListPermissionAssociations.ts

Runtime binding for ram:ListPermissionAssociations.

Lists information about managed permissions and their associations to resource shares. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListPermissionAssociationsHttp).

ListPermissionAssociations: Managed Permissions

// init — account-level binding, no resource argument
const listPermissionAssociations = yield* AWS.RAM.ListPermissionAssociations();

// runtime
const { permissions } = yield* listPermissionAssociations({
  defaultVersion: true,
});

ListPermissions

Source: src/AWS/RAM/ListPermissions.ts

Runtime binding for ram:ListPermissions.

Lists the AWS managed and customer managed RAM permissions available for the supported resource types. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListPermissionsHttp).

ListPermissions: Managed Permissions

// init — account-level binding, no resource argument
const listPermissions = yield* AWS.RAM.ListPermissions();

// runtime
const { permissions } = yield* listPermissions({
  permissionType: "CUSTOMER_MANAGED",
});

ListPermissionVersions

Source: src/AWS/RAM/ListPermissionVersions.ts

Runtime binding for ram:ListPermissionVersions.

Lists the available versions of the specified RAM permission. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListPermissionVersionsHttp).

ListPermissionVersions: Managed Permissions

// init — account-level binding, no resource argument
const listPermissionVersions = yield* AWS.RAM.ListPermissionVersions();

// runtime
const { permissions } = yield* listPermissionVersions({
  permissionArn: permission.permissionArn,
});

ListPrincipals

Source: src/AWS/RAM/ListPrincipals.ts

Runtime binding for ram:ListPrincipals.

Lists the principals that you are sharing resources with or that are sharing resources with you. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListPrincipalsHttp).

ListPrincipals: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const listPrincipals = yield* AWS.RAM.ListPrincipals();

// runtime
const { principals } = yield* listPrincipals({ resourceOwner: "SELF" });

ListResources

Source: src/AWS/RAM/ListResources.ts

Runtime binding for ram:ListResources.

Lists the resources that you added to resource shares or that are shared with you. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListResourcesHttp).

ListResources: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const listResources = yield* AWS.RAM.ListResources();

// runtime
const { resources } = yield* listResources({
  resourceOwner: "OTHER-ACCOUNTS",
});

ListResourceSharePermissions

Source: src/AWS/RAM/ListResourceSharePermissions.ts

Runtime binding for ram:ListResourceSharePermissions.

Lists the RAM permissions that are associated with a resource share. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListResourceSharePermissionsHttp).

ListResourceSharePermissions: Managed Permissions

// init — account-level binding, no resource argument
const listResourceSharePermissions = yield* AWS.RAM.ListResourceSharePermissions();

// runtime
const { permissions } = yield* listResourceSharePermissions({
  resourceShareArn: share.resourceShareArn,
});

ListResourceTypes

Source: src/AWS/RAM/ListResourceTypes.ts

Runtime binding for ram:ListResourceTypes.

Lists the resource types that can be shared through RAM. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListResourceTypesHttp).

ListResourceTypes: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const listResourceTypes = yield* AWS.RAM.ListResourceTypes();

// runtime
const { resourceTypes } = yield* listResourceTypes();

ListSourceAssociations

Source: src/AWS/RAM/ListSourceAssociations.ts

Runtime binding for ram:ListSourceAssociations.

Lists the source associations of your resource shares — the sources that service-managed shares draw resources from. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.ListSourceAssociationsHttp).

ListSourceAssociations: Discovering Shares & Shared Resources

// init — account-level binding, no resource argument
const listSourceAssociations = yield* AWS.RAM.ListSourceAssociations();

// runtime
const { sourceAssociations } = yield* listSourceAssociations();

Permission

Source: src/AWS/RAM/Permission.ts

An AWS Resource Access Manager (RAM) customer managed permission.

A customer managed permission precisely controls which actions principals receive on resources of a given type when you attach the permission to a ResourceShare via permissionArns.

Permission: Creating a Permission

Least-privilege AppSync API sharing

const permission = yield* Permission("SourceGraphQLOnly", {
  resourceType: "appsync:Apis",
  policyTemplate: {
    actions: ["appsync:SourceGraphQL"],
  },
});

Attach a permission to a resource share

const share = yield* ResourceShare("ApiShare", {
  resourceArns: [api.apiArn],
  principals: ["123456789012"],
  permissionArns: [permission.permissionArn],
});

Permission: Updating the Policy

const permission = yield* Permission("SourceGraphQLOnly", {
  resourceType: "appsync:Apis",
  policyTemplate: {
    actions: ["appsync:SourceGraphQL", "appsync:GraphQL"],
  },
});

RejectResourceShareInvitation

Source: src/AWS/RAM/RejectResourceShareInvitation.ts

Runtime binding for ram:RejectResourceShareInvitation.

Rejects an invitation to a resource share from another account. Account-level operation — the target shares, invitations, and permissions are chosen per request at runtime, so the binding takes no resource argument. Provide the implementation with Effect.provide(AWS.RAM.RejectResourceShareInvitationHttp).

RejectResourceShareInvitation: Invitations

// init — account-level binding, no resource argument
const rejectResourceShareInvitation = yield* AWS.RAM.RejectResourceShareInvitation();

// runtime
const { resourceShareInvitation } =
  yield* rejectResourceShareInvitation({
    resourceShareInvitationArn: invitationArn,
  });

ResourceShare

Source: src/AWS/RAM/ResourceShare.ts

An AWS Resource Access Manager (RAM) resource share.

A resource share grants principals (accounts, organizational units, or IAM identities) access to a set of shared resources identified by ARN.

ResourceShare: Creating a Resource Share

Share subnets with an organizational unit

const share = yield* ResourceShare("NetworkShare", {
  resourceArns: [subnet.subnetArn],
  principals: [ou.ouArn],
  allowExternalPrincipals: false,
});

Share with an external account

const share = yield* ResourceShare("ExternalShare", {
  resourceArns: [resolverRule.arn],
  principals: ["123456789012"],
  allowExternalPrincipals: true,
  tags: { team: "platform" },
});