AWS Resource Access Manager

Name: AWS Resource Access Manager API
Brand: AWS Resource Access Manager
Availability: InStock

★ Only Publicly Available OpenAPI DocumentIdentity AuthAuthorizationhmac34 Endpoints

Install Jentic One Beta

Connect the AWS Resource Access Manager to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the AWS Resource Access Manager, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with AWS Resource Access Manager API.

Create resource shares with resourceArns, principals, and attached permissions via CreateResourceShare

Associate or disassociate principals (account IDs, OUs, the entire org) with an existing resource share

Add or remove resource ARNs from an existing resource share without recreating it

GET STARTED

Start building with AWS Resource Access Manager API

Explore with Jentic

View OpenAPI Document

For Agents

Share AWS resources across accounts and organizations through resource shares, principal and resource associations, invitations, and customer managed permissions.

Use for: I need to share a Transit Gateway with another AWS account, Create a resource share for a list of subnet ARNs, Associate an entire Organizational Unit with an existing resource share, Accept a pending RAM invitation by ARN

Not supported: Does not provision the underlying resources, grant IAM permissions to users, or replicate data - use for cross-account and cross-organization sharing of existing AWS resources only.

Jentic publishes the only available OpenAPI specification for AWS Resource Access Manager (RAM), keeping it validated and agent-ready. RAM lets you share AWS resources across accounts and AWS Organizations: subnets, Transit Gateways, Route 53 Resolver rules, Capacity Reservations, License Manager configurations, and dozens more. The 34-operation API covers creating and updating resource shares, managing principal and resource associations, accepting or rejecting invitations, and authoring customer managed permissions. It is the control plane for centralized resource sharing in multi-account AWS estates.

Use Cases

Patterns agents use AWS Resource Access Manager API for, with concrete tasks.

★ Centralized VPC Subnet Sharing

Share VPC subnets from a network account to workload accounts so that EC2, RDS, and EKS resources in those accounts can be launched into shared subnets. CreateResourceShare with the subnet ARNs and the target accounts (or the entire AWS Organization) sets up the share, and AssociateResourceShare adds principals later. This eliminates per-account VPC duplication in landing-zone designs.

Call POST /createresourceshare with name 'shared-private-subnets', resourceArns of the subnet ARNs, principals as the target account IDs, and allowExternalPrincipals false

Org-Wide Transit Gateway Sharing

Share a Transit Gateway across an entire AWS Organization so every workload account can attach VPCs to it. AssociateResourceShare with the OrganizationArn (or specific OU ARNs) propagates access via the AWS service-managed permission. Pair with EnableSharingWithAwsOrganization to allow OU principals on shares.

Call POST /enablesharingwithawsorganization, then POST /associateresourceshare with the resource share ARN and principals containing the AWS Organization ARN

Custom Permissions for Shared Licenses

Limit what consumer accounts can do with shared resources by authoring customer managed permissions. CreatePermission and CreatePermissionVersion accept JSON policy documents that scope the actions allowed on the shared resource type, and AssociateResourceSharePermission attaches the permission to a share. Useful for shared License Manager configurations or shared Outpost capacity.

Call POST /createpermission with name 'license-read-only', resourceType 'license-manager:LicenseConfiguration', and a policy template restricting actions to ListAssociations and GetLicenseConfiguration

AI Agent Resource Sharing Tool via Jentic

A platform agent uses Jentic to discover RAM operations and automate sharing flows for new accounts joining the organization. Jentic stores AWS credentials in its vault and signs each call with SigV4, so the agent only handles the resource ARNs and target principals while landing-zone policies stay enforced.

Use Jentic to search 'create a resource share in aws ram', load CreateResourceShare, and execute it with the target resourceArns and principal account IDs

Key Endpoints

34 endpoints — jentic publishes the only available openapi specification for aws resource access manager (ram), keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/createresourceshare

Create a resource share with resourceArns, principals, and permissions

POST

/associateresourceshare

Add principals or resources to an existing resource share

POST

/disassociateresourceshare

Remove principals or resources from a share

POST

/acceptresourceshareinvitation

Accept a pending share invitation from another account

POST

/createpermission

Create a customer managed permission policy

POST

/enablesharingwithawsorganization

Enable RAM to use AWS Organizations as principals

POST

/createresourceshare

Create a resource share with resourceArns, principals, and permissions

POST

/associateresourceshare

Add principals or resources to an existing resource share

POST

/disassociateresourceshare

Remove principals or resources from a share

POST

/acceptresourceshareinvitation

Accept a pending share invitation from another account

POST

/createpermission

Create a customer managed permission policy

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to produce a SigV4 signature per request. The raw secret access key never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create a resource share in AWS RAM', and Jentic returns CreateResourceShare with its input schema for resourceArns, principals, and permissionArns so the agent calls the right endpoint without browsing the reference docs.

Time to first call

FAQs

Specific to using AWS Resource Access Manager API through Jentic.

Why is there no official OpenAPI spec for AWS Resource Access Manager?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Resource Access Manager via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the AWS RAM API use?

RAM uses AWS SigV4 HMAC request signing with an AWS access key ID and secret. Through Jentic, AWS credentials are stored in the vault and SigV4 signatures are produced per request, so the agent never sees raw secrets.

Can I share resources with an entire AWS Organization?

Yes. Call POST /enablesharingwithawsorganization once per management account, then pass the AWS Organization ARN or an OU ARN as a principal in CreateResourceShare or AssociateResourceShare. Without enableSharingWithAwsOrganization, only individual account IDs work as principals.

Which resource types can RAM share?

Supported types include VPC subnets, Transit Gateways, Route 53 Resolver rules and forwarding rules, License Manager configurations, AppMesh meshes, Capacity Reservations, Outposts, and dozens more. Call POST /listresourcetypes to retrieve the current list for your region.

What are the rate limits for the AWS RAM API?

RAM enforces account-level request quotas per region; throttled calls return ThrottlingException. AWS does not publish a fixed per-second number for every operation, so back off and retry on throttles, particularly on bulk Associate or Disassociate flows.

How do I create a resource share through Jentic?

Search Jentic for 'create a resource share in aws ram', load CreateResourceShare, and execute it with name, resourceArns, and principals. Install with pip install jentic; AWS credentials are pulled from your Jentic One instance.

Can I limit what my agent is allowed to do with the AWS RAM API?

Yes. Because Jentic One is self-hosted, you decide which RAM operations the agent may call and which AWS credentials it uses, so you can allow only the ones it needs, such as CreateResourceShare and AssociateResourceShare. The resource share, principals, and permissions travel in the request body rather than the URL path, so scoping happens at the operation level rather than by path. Destructive operations like DeleteResourceShare and DisassociateResourceShare stay out of reach unless you explicitly add them.

AWS Resource Access Manager

Connect the AWS Resource Access Manager to your agent

Capabilities

Start building with AWS Resource Access Manager API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs