AWS ram documentation change

Service: ram · 2025-03-02 · Documentation low

File: ram/latest/userguide/security-iam-policies-examples.md

Summary

Added detailed explanation about AWS RAM authorization logic and updated policy example to include new section for allowing principal association

Security assessment

The changes add more detailed documentation about security policies and authorization logic in AWS RAM, but there is no evidence this is related to addressing a specific security issue

Diff

diff --git a/ram/latest/userguide/security-iam-policies-examples.md
index 5969bbef1..2e0d8c190 100644
--- a/ram/latest/userguide/security-iam-policies-examples.md
+++ b/ram/latest/userguide/security-iam-policies-examples.md
@@ -49 +49,3 @@ You can use an IAM policy to limit principals to associating only specific resou
-For example, the following policy limits principals to sharing only resolver rules.
+The actions, `AssociateResourceShare` and `CreateResourceShare`, can accept principals and `resourceArns` as independent input parameters. Therefore, AWS RAM authorizes each principal and resource independently, so there could be multiple [request contexts](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic_policy-eval-reqcontext.html). This means when a principal is being associated to a AWS RAM resource share, the `ram:RequestedResourceType` condition key is not present in the request context. Similarly, when a resource is being associated to a AWS RAM resource share, the `ram:Principal` condition key is not present in the request context. Therefore, to allow `AssociateResourceShare` and `CreateResourceShare` when associating principals to the AWS RAM resource share, you can use the [`Null` condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html#Conditions_Null). 
+
+For example, the following policy limits principals to sharing only Amazon Route 53 resolver rules and allows them to associate any principal to that share.
@@ -54,0 +57 @@ For example, the following policy limits principals to sharing only resolver rul
+            "Sid": "AllowOnlySpecificResourceType",
@@ -59 +62 @@ For example, the following policy limits principals to sharing only resolver rul
-                "StringEqualsIfExists": {
+                "StringEquals": {
@@ -63 +66,13 @@ For example, the following policy limits principals to sharing only resolver rul
-        }]
+        },
+        {
+        "Sid": "AllowAssociatingPrincipals",
+         "Effect": "Allow",
+            "Action": ["ram:CreateResourceShare", "ram:AssociateResourceShare"],
+            "Resource": "*",
+            "Condition": {
+                "Null": {
+                    "ram:Principal": "false"
+                 }
+            }
+        }
+      ]