Share your VPC Lattice resources

Amazon VPC Lattice integrates with AWS Resource Access Manager (AWS RAM) to enable resource sharing. AWS RAM is a service that enables you to share some VPC Lattice resources with other AWS accounts or through AWS Organizations. With AWS RAM, you share resources that you own by creating a resource share. A resource share specifies the resources to share, and the consumers with whom to share them. Consumers can include:

For more information about AWS RAM, see the AWS RAM User Guide.

Prerequisites for sharing VPC Lattice resources

Share VPC Lattice resources

To share a resource, start by creating a resource share using AWS Resource Access Manager. A resource share specifies the resources to share, the consumers with whom they are shared, and what actions principals can perform.

When you share a VPC Lattice resource that you own with other AWS accounts, you enable those accounts to associate their resources with resources in your account. When you create an association against a shared resource, we generate an Amazon Resource Name (ARN) in the resource owner account and in the account that created the association. Therefore, both the resource owner and the account that created the association can delete the association.

If you are part of an organization in AWS Organizations and sharing within your organization is enabled, consumers in your organization are automatically granted access to the shared resource. Otherwise, consumers receive an invitation to join the resource share and are granted access to the shared resource after accepting the invitation.

To share a resource that you own using the AWS RAM console

Use the procedure described in Create a resource share in the AWS RAM User Guide.

To share a resource that you own using the AWS CLI

Use the associate-resource-share command.

Stop sharing VPC Lattice resources

To stop sharing a VPC Lattice resource that you own, you must remove it from the resource share. Existing associations persist after you stop sharing your resource. New associations to a previously shared resource are not allowed. When either the resource owner or the association owner deletes an association, it is deleted from both accounts. If an account owner wants to leave a resource share, they must ask the owner of the resource share to remove the account.

To stop sharing a resource that you own using the AWS RAM console

See Update a resource share in the AWS RAM User Guide.

To stop sharing a resource that you own using the AWS CLI

Use the disassociate-resource-share command.

Responsibilities and permissions

The following responsibilities and permissions apply when using shared VPC Lattice resources.

Resource owners

Resource consumers

Cross-account events

When resource owners and consumers perform actions on a shared resource, those actions are recorded as cross-account events in AWS CloudTrail.

The following is an example entry for the CreateServiceNetworkServiceAssociationBySharee event.

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown"
    },
    "eventTime": "2023-04-27T17:12:46Z",
    "eventSource": "vpc-lattice.amazonaws.com",
    "eventName": "CreateServiceNetworkServiceAssociationBySharee",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "vpc-lattice.amazonaws.com",
    "userAgent": "ec2.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "additionalEventData": {
        "callerAccountId": "111122223333"
    },
    "requestID": "ddabb0a7-70c6-4f70-a6c9-00cbe8a6a18b",
    "eventID": "bd03cdca-7edd-4d50-b9c9-eaa89f4a47cd",
    "readOnly": false,
    "resources": [
        {
            "accountId": "123456789012",
            "type": "AWS::VpcLattice::ServiceNetworkServiceAssociation",
            "ARN": "arn:aws:vpc-lattice:region:123456789012:servicenetworkserviceassociation/snsa-0d5ea7bc72EXAMPLE"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "123456789012",
    "eventCategory": "Management"
}