AWS ram documentation change
Summary
Updated Incident Manager 'Contacts' and 'Response plans' sections to emphasize cross-account incident management capabilities.
Security assessment
Enhances documentation for incident response workflows, which are part of security operations, but does not resolve a specific vulnerability.
Diff
diff --git a/ram/latest/userguide/shareable.md b/ram/latest/userguide/shareable.md index 3e4c0e288..36827048d 100644 --- a//ram/latest/userguide/shareable.md +++ b//ram/latest/userguide/shareable.md @@ -5 +5 @@ -AWS App MeshAWS AppSync GraphQL APIAmazon API GatewayAmazon Application Recovery Controller (ARC)Amazon AuroraAWS BackupAmazon BedrockAWS Billing View ServiceAWS CloudHSMAWS Cloud MapAWS CodeBuildAWS CodeConnectionsAmazon DataZoneAmazon EC2EC2 Image BuilderElastic Load BalancingAWS End User Messaging SMSAmazon FSx for OpenZFSAWS GlueAWS License ManagerAWS MarketplaceAWS Migration Hub Refactor SpacesMulti-party approvalAWS Network FirewallOracle Database@AWSAWS OutpostsAmazon S3 on OutpostsAWS Private Certificate AuthorityAWS Resource ExplorerAWS Resource GroupsAmazon Route 53Amazon Simple Storage ServiceAmazon SageMaker AIAWS Service Catalog AppRegistryAWS Systems Manager Incident ManagerAWS Systems ManagerAmazon VPCAmazon VPC LatticeAWS Cloud WAN +AWS App MeshAWS AppSync GraphQL APIAmazon API GatewayAmazon Application Recovery Controller (ARC)Amazon AuroraAWS BackupAmazon BedrockBilling and Cost ManagementAWS Billing View ServiceAWS CloudHSMAWS Cloud MapAWS CodeBuildAWS CodeConnectionsAmazon DataZoneAmazon EC2EC2 Image BuilderElastic Load BalancingAWS End User Messaging SMSAmazon FSx for OpenZFSAWS GlueAWS License ManagerAWS MarketplaceAWS Migration Hub Refactor SpacesMulti-party approvalAWS Network FirewallOracle Database@AWSAWS OutpostsAmazon S3 on OutpostsAWS Private Certificate AuthorityAWS Resource ExplorerAWS Resource GroupsAmazon Route 53Amazon Simple Storage ServiceAmazon SageMaker AIAWS Service Catalog AppRegistryAWS Systems Manager Incident ManagerAWS Systems ManagerAmazon VPCAmazon VPC LatticeAWS Cloud WAN @@ -25 +25 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Mesh `appmesh:Mesh` | Create and manage a mesh centrally, and share it with other AWS accounts or your organization. A shared mesh allows resources created by different AWS accounts to communicate with each other in the same mesh. For more information, see [ Working with shared meshes](https://docs.aws.amazon.com/app-mesh/latest/userguide/sharing.html) in the _AWS App Mesh User Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +Meshes `appmesh:Mesh` | Create and manage a mesh centrally, and share it with other AWS accounts or your organization. A shared mesh allows resources created by different AWS accounts to communicate with each other in the same mesh. For more information, see [ Working with shared meshes](https://docs.aws.amazon.com/app-mesh/latest/userguide/sharing.html) in the _AWS App Mesh User Guide_. | Yes | Yes Can share with **any** AWS account. | No | No @@ -33 +33 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -GraphyQL API `appsync:Apis` | Manage AWS AppSync GraphQL APIs centrally, and share them with other AWS accounts or your organization. This lets multiple accounts share AWS AppSync APIs as part of creating a unified AWS AppSync Merged API which can access data from multiple subschema APIs across different accounts in the same Region. For more information, see [Merged APIs](https://docs.aws.amazon.com/appsync/latest/devguide/merged-api.html) in the _AWS AppSync Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +AppSync GraphyQL APIs `appsync:Apis` | Manage AWS AppSync GraphQL APIs centrally, and share them with other AWS accounts or your organization. This lets multiple accounts share AWS AppSync APIs as part of creating a unified AWS AppSync Merged API which can access data from multiple subschema APIs across different accounts in the same Region. For more information, see [Merged APIs](https://docs.aws.amazon.com/appsync/latest/devguide/merged-api.html) in the _AWS AppSync Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -41 +41 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Domain name `apigateway:Domainnames` | Create and manage domain names centrally, and share them with other AWS accounts or your organization. This lets multiple accounts invoke your domain names that are mapped to private APIs. For more information, see [Custom domain names for private APIs in API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-custom-domains.html) in the _Amazon API Gateway Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No +API Gateway Private Custom Domains `apigateway:Domainnames` | Create and manage domain names centrally, and share them with other AWS accounts or your organization. This lets multiple accounts invoke your domain names that are mapped to private APIs. For more information, see [Custom domain names for private APIs in API Gateway](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-custom-domains.html) in the _Amazon API Gateway Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No @@ -49,2 +49,2 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -ARC cluster `route53-recovery-control:Cluster` | Create and manage ARC clusters centrally, and share them with other AWS accounts or your organization. This lets multiple accounts create control panels and routing controls in a single shared cluster, reducing complexity and the total number of clusters an organization requires. For more information, see [Sharing clusters across accounts](https://docs.aws.amazon.com/r53recovery/latest/dg/routing-control.failover-different-accounts.html) in the _Amazon Application Recovery Controller (ARC) Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -ARC Region switch plan `arc-region-switch:Plan` | Create and manage plans centrally, and share them with other AWS accounts or your organization. This lets multiple accounts use resources from an account that is different from the account that hosts the plan. For more information, see [Region switch](https://docs.aws.amazon.com/r53recovery/latest/dg/region-switch.html) in the _Amazon Application Recovery Controller (ARC) Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Route 53 ARC Clusters `route53-recovery-control:Cluster` | Create and manage ARC clusters centrally, and share them with other AWS accounts or your organization. This lets multiple accounts create control panels and routing controls in a single shared cluster, reducing complexity and the total number of clusters an organization requires. For more information, see [Sharing clusters across accounts](https://docs.aws.amazon.com/r53recovery/latest/dg/routing-control.failover-different-accounts.html) in the _Amazon Application Recovery Controller (ARC) Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +ARC Region switch plans `arc-region-switch:Plan` | Create and manage plans centrally, and share them with other AWS accounts or your organization. This lets multiple accounts use resources from an account that is different from the account that hosts the plan. For more information, see [Region switch](https://docs.aws.amazon.com/r53recovery/latest/dg/region-switch.html) in the _Amazon Application Recovery Controller (ARC) Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -58 +58 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -DB clusters `rds:Cluster` | Create and manage a DB cluster centrally, and share it with other AWS accounts or your organization. This lets multiple AWS accounts clone a shared, centrally managed DB cluster. For more information, see [ Cross-account cloning with AWS RAM and Amazon Aurora](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html#Aurora.Managing.Clone.Cross-Account) in the _Amazon Aurora User Guide_. | No | Yes Can share with **any** AWS account. | No | No +Aurora DB Clusters `rds:Cluster` | Create and manage a DB cluster centrally, and share it with other AWS accounts or your organization. This lets multiple AWS accounts clone a shared, centrally managed DB cluster. For more information, see [ Cross-account cloning with AWS RAM and Amazon Aurora](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Clone.html#Aurora.Managing.Clone.Cross-Account) in the _Amazon Aurora User Guide_. | No | Yes Can share with **any** AWS account. | No | No @@ -66 +66 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -BackupVault `backup:BackupVault` | Create and manage logically air-gapped vaults centrally and share them with other AWS accounts or your organization. This option lets multiple accounts access and restore backups from the vault(s). For more information, see [Overview of logically air gapped vaults](https://docs.aws.amazon.com/aws-backup/latest/devguide/logicallyairgappedvault.html) in the _AWS Backup Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Backup Vaults `backup:BackupVault` | Create and manage logically air-gapped vaults centrally and share them with other AWS accounts or your organization. This option lets multiple accounts access and restore backups from the vault(s). For more information, see [Overview of logically air gapped vaults](https://docs.aws.amazon.com/aws-backup/latest/devguide/logicallyairgappedvault.html) in the _AWS Backup Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -74 +74,9 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Custom Model `bedrock:CustomModel` | Create and manage custom model centrally, and share it with other AWS accounts or your organization. This lets multiple accounts use the same custom model for generative AI applications. For more information, see [Share a model for another account](https://docs.aws.amazon.com/bedrock/latest/userguide/share-model.html) in the _Amazon Bedrock User Guide_. | Yes | No Can share with **only** AWS accounts in its own organization. | Yes | No +Bedrock Custom Model `bedrock:CustomModel` | Create and manage custom model centrally, and share it with other AWS accounts or your organization. This lets multiple accounts use the same custom model for generative AI applications. For more information, see [Share a model for another account](https://docs.aws.amazon.com/bedrock/latest/userguide/share-model.html) in the _Amazon Bedrock User Guide_. | Yes | No Can share with **only** AWS accounts in its own organization. | Yes | No + +## Billing and Cost Management + +You can share the following Billing and Cost Management resources by using AWS RAM. + +Resource type and code | Use case | Can share with IAM users and roles | Can share with accounts outside its organization | Can use customer managed permissions | Can share with service principals +---|---|---|---|---|--- +BCM Dashboards `bcm-dashboards:dashboard` | Create and manage Billing and Cost Management dashboards and share them with other AWS accounts within or outside your organization. When you share a dashboard, only dashboard configurations are shared, not the underlying data. Recipients receive access to the dashboard layout and widget configurations, and will see data based on their own access permissions. This sharing capability allows organizations to establish common cost reporting practices and helps different teams view cost data consistently. For more information, see [Sharing dashboards](https://docs.aws.amazon.com/cost-management/latest/userguide/share-dashboards.html) in the _Billing and Cost Management User Guide_. | No | Yes Can share with **any** AWS account. | Yes | No @@ -82 +90 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Billing View `billing:billingview` | Create and manage custom billing views centrally, and share them with other AWS accounts or your organization. This lets application and business unit owners access business unit-level AWS spend from a member account. For more information, see [Controlling cost management data access with Billing View](https://docs.aws.amazon.com/cost-management/latest/userguide/billing-view.html) in the _AWS Cost Management User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | Yes | No +Billing Views `billing:billingview` | Create and manage custom billing views centrally, and share them with other AWS accounts or your organization. This lets application and business unit owners access business unit-level AWS spend from a member account. For more information, see [Sharing custom billing views](https://docs.aws.amazon.com/cost-management/latest/userguide/share-custom-billing-views.html) in the _AWS Cost Management User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | Yes | No @@ -90 +98 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -AWS CloudHSM Backup `cloudhsm:Backup` | Manage AWS CloudHSM Backups centrally, and share them with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the Backup and use it to restore a AWS CloudHSM Cluster. For more information, see [Managing AWS CloudHSM backups](https://docs.aws.amazon.com/cloudhsm/latest/userguide/manage-backups.html) in the _AWS CloudHSM User Guide_. | Yes | Yes | Yes | No +AWS CloudHSM Backups `cloudhsm:Backup` | Manage AWS CloudHSM Backups centrally, and share them with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the Backup and use it to restore a AWS CloudHSM Cluster. For more information, see [Managing AWS CloudHSM backups](https://docs.aws.amazon.com/cloudhsm/latest/userguide/manage-backups.html) in the _AWS CloudHSM User Guide_. | Yes | Yes | Yes | No @@ -98 +106 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -AWS Cloud Map namespace `servicediscovery:Namespace` | Create and manage namespaces centrally, and share them with other AWS accounts within your organization. This lets multiple AWS accounts discover services and instances in the shared namespace without the need for temporary credentials. For more information, see [Shared AWS Cloud Map namespaces](https://docs.aws.amazon.com/cloud-map/latest/dg/sharing-namespaces.html) in the _AWS Cloud Map Developer Guide_. | Yes | No Can share with **only** AWS accounts in its own organization. | Yes | No +AWS Cloud Map Namespaces `servicediscovery:Namespace` | Create and manage namespaces centrally, and share them with other AWS accounts within your organization. This lets multiple AWS accounts discover services and instances in the shared namespace without the need for temporary credentials. For more information, see [Shared AWS Cloud Map namespaces](https://docs.aws.amazon.com/cloud-map/latest/dg/sharing-namespaces.html) in the _AWS Cloud Map Developer Guide_. | Yes | No Can share with **only** AWS accounts in its own organization. | Yes | No @@ -106,2 +114,2 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Project `codebuild:Project` | Create a project, and use it to run builds. Share the project with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about a project and analyze its builds. For more information, see [Working with shared projects](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html) in the _AWS CodeBuild User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -Report group `codebuild:ReportGroup` | Create a report group, and use it to create reports when you build a project. Share the report group with other AWS accounts or your organization. This lets multiple AWS accounts and users view the report group and its reports, and the test case results for each report. A report can be viewed for 30 days after it's created, and then it expires and is no longer available to view. For more information, see [Working with shared projects](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html) in the _AWS CodeBuild User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +CodeBuild Projects `codebuild:Project` | Create a project, and use it to run builds. Share the project with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about a project and analyze its builds. For more information, see [Working with shared projects](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html) in the _AWS CodeBuild User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +CodeBuild Report groups `codebuild:ReportGroup` | Create a report group, and use it to create reports when you build a project. Share the report group with other AWS accounts or your organization. This lets multiple AWS accounts and users view the report group and its reports, and the test case results for each report. A report can be viewed for 30 days after it's created, and then it expires and is no longer available to view. For more information, see [Working with shared projects](https://docs.aws.amazon.com/codebuild/latest/userguide/project-sharing.html) in the _AWS CodeBuild User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -123 +131 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -DataZone Domain `datazone:Domain` | Create and manage domains centrally, and share it with other AWS accounts or your organization. This lets multiple accounts create Amazon DataZone domains. For more information, see [What is Amazon DataZone](https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html) in the _Amazon DataZone User Guide_. | No | Yes Can share with **any** AWS account. | No | No +DataZone Domains `datazone:Domain` | Create and manage domains centrally, and share it with other AWS accounts or your organization. This lets multiple accounts create Amazon DataZone domains. For more information, see [What is Amazon DataZone](https://docs.aws.amazon.com/datazone/latest/userguide/what-is-datazone.html) in the _Amazon DataZone User Guide_. | No | Yes Can share with **any** AWS account. | No | No @@ -145,4 +153,4 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Components `imagebuilder:Component` | Create and manage components centrally, and share them with other AWS accounts or your organization. Manage who can use predefined build and test components in their image recipes. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -Container recipes `imagebuilder:ContainerRecipe` | Create and manage your container recipes centrally, and share them with other AWS accounts or your organization. This allows you to manage who can use predefined documents to duplicate container image builds. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -Images `imagebuilder:Image` | Create and manage your golden images centrally, and share them with other AWS accounts or your organization. Manage who can use images created with EC2 Image Builder across your organization. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -Image recipes `imagebuilder:ImageRecipe` | Create and manage your image recipes centrally, and share them with other AWS accounts or your organization. This allows you to manage who can use predefined documents to duplicate AMI builds. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Image Builder Components `imagebuilder:Component` | Create and manage components centrally, and share them with other AWS accounts or your organization. Manage who can use predefined build and test components in their image recipes. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Image Builder Container recipes `imagebuilder:ContainerRecipe` | Create and manage your container recipes centrally, and share them with other AWS accounts or your organization. This allows you to manage who can use predefined documents to duplicate container image builds. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Image Builder Images `imagebuilder:Image` | Create and manage your golden images centrally, and share them with other AWS accounts or your organization. Manage who can use images created with EC2 Image Builder across your organization. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Image Builder Image recipes `imagebuilder:ImageRecipe` | Create and manage your image recipes centrally, and share them with other AWS accounts or your organization. This allows you to manage who can use predefined documents to duplicate AMI builds. For more information, see [ Share EC2 Image Builder resources](https://docs.aws.amazon.com/imagebuilder/latest/userguide/manage-shared-resources.html) in the _EC2 Image Builder User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -156 +164 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Trust stores `elasticloadbalancing:TrustStore` | Create and manage Elastic Load Balancing trust stores centrally, and share them with other AWS accounts or your organization. Security admins can maintain a single or smaller number of trust stores and enable Mutual TLS configurations across Application Load Balancers. For more information, see [Share your Elastic Load Balancing trust store for Application Load Balancers ](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/trust-store-sharing.html) in the _User Guide for Application Load Balancers_. | Yes | Yes | No | No +ELB Trust stores `elasticloadbalancing:TrustStore` | Create and manage Elastic Load Balancing trust stores centrally, and share them with other AWS accounts or your organization. Security admins can maintain a single or smaller number of trust stores and enable Mutual TLS configurations across Application Load Balancers. For more information, see [Share your Elastic Load Balancing trust store for Application Load Balancers ](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/trust-store-sharing.html) in the _User Guide for Application Load Balancers_. | Yes | Yes | No | No @@ -164,4 +172,4 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Opt-out list `sms-voice:OptOutList` | Create an opt-out list and share it with other AWS accounts in your organization. You can share the opt-out list so the other applications can opt out user's phone numbers from different AWS accounts or they can check the status of the user's phone number. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | No -Phone number `sms-voice:PhoneNumber` | Create and manage phone numbers to share them with other AWS accounts or your organization. This lets multiple AWS accounts send messages using the shared phone number. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | Yes -Pool `sms-voice:Pool` | Create and manage pools to share them with other AWS accounts or your organization. This lets multiple AWS accounts send messages using the shared pool. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | Yes -Sender ID `sms-voice:SenderId` | Create and manage sender IDs and share them with other AWS accounts or your organization. This lets multiple AWS accounts send messages using the shared sender ID. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | Yes +AWS SMS Voice Opt out lists`sms-voice:OptOutList` | Create an opt-out list and share it with other AWS accounts in your organization. You can share the opt-out list so the other applications can opt out user's phone numbers from different AWS accounts or they can check the status of the user's phone number. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | No +AWS SMS Voice Phone numbers `sms-voice:PhoneNumber` | Create and manage phone numbers to share them with other AWS accounts or your organization. This lets multiple AWS accounts send messages using the shared phone number. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | Yes +AWS SMS Voice Pool `sms-voice:Pool` | Create and manage pools to share them with other AWS accounts or your organization. This lets multiple AWS accounts send messages using the shared pool. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | Yes +AWS SMS Voice Sender IDs `sms-voice:SenderId` | Create and manage sender IDs and share them with other AWS accounts or your organization. This lets multiple AWS accounts send messages using the shared sender ID. For more information, see [Working with shared resources](https://docs.aws.amazon.com/sms-voice/latest/userguide/shared-resources.html) in the in AWS End User Messaging SMS User Guide. | No | Yes Can share with **any** AWS account. | Yes | Yes @@ -175 +183 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -FSx Volume `fsx:Volume` | Create and manage FSx for OpenZFS volumes centrally, and share them with other AWS accounts or your organization. This lets multiple accounts perform data replication using OpenZfs snapshots under shared volumes through FSx APIs `CreateVolume` or `CopySnapshotAndUpdateVolume`. For more information, see [On-demand data replication](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/on-demand-replication.html) in the _Amazon FSx for OpenZFS User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +FSx Volumes `fsx:Volume` | Create and manage FSx for OpenZFS volumes centrally, and share them with other AWS accounts or your organization. This lets multiple accounts perform data replication using OpenZfs snapshots under shared volumes through FSx APIs `CreateVolume` or `CopySnapshotAndUpdateVolume`. For more information, see [On-demand data replication](https://docs.aws.amazon.com/fsx/latest/OpenZFSGuide/on-demand-replication.html) in the _Amazon FSx for OpenZFS User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -183,3 +191,3 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Data catalogs `glue:Catalog` | Manage a central data catalog, and share metadata about databases and tables with AWS accounts or your organization. This enables users to run queries on data across multiple accounts. For more information, see [Sharing Data Catalog Tables and Databases Across AWS Accounts](https://docs.aws.amazon.com/lake-formation/latest/dg/sharing-catalog-resources.html) in the _AWS Lake Formation Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No -Databases `glue:Database` | Create and manage data catalog databases centrally, and share them with AWS accounts or your organization. Databases are collections of data catalog tables. This enables users to run queries and extract, transform, and load (ETL) jobs that can join and query data across multiple accounts. For more information, see [ Sharing Data Catalog Tables and Databases Across AWS Accounts](https://docs.aws.amazon.com/lake-formation/latest/dg/sharing-catalog-resources.html) in the _AWS Lake Formation Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No -Tables `glue:Table` | Create and manage data catalog tables centrally, and share them with AWS accounts or your organization. Data catalog tables contain metadata about data tables in Amazon S3, JDBC data sources, Amazon Redshift, streaming sources, and other data stores. This enables users to run queries and ETL jobs that can join and query data across multiple accounts. For more information, see [Sharing Data Catalog Tables and Databases Across AWS Accounts](https://docs.aws.amazon.com/lake-formation/latest/dg/sharing-catalog-resources.html) in the _AWS Lake Formation Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No +AWS Glue Catalog `glue:Catalog` | Manage a central data catalog, and share metadata about databases and tables with AWS accounts or your organization. This enables users to run queries on data across multiple accounts. For more information, see [Sharing Data Catalog Tables and Databases Across AWS Accounts](https://docs.aws.amazon.com/lake-formation/latest/dg/sharing-catalog-resources.html) in the _AWS Lake Formation Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No +AWS Glue Databases `glue:Database` | Create and manage data catalog databases centrally, and share them with AWS accounts or your organization. Databases are collections of data catalog tables. This enables users to run queries and extract, transform, and load (ETL) jobs that can join and query data across multiple accounts. For more information, see [ Sharing Data Catalog Tables and Databases Across AWS Accounts](https://docs.aws.amazon.com/lake-formation/latest/dg/sharing-catalog-resources.html) in the _AWS Lake Formation Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No +AWS Glue Tables `glue:Table` | Create and manage data catalog tables centrally, and share them with AWS accounts or your organization. Data catalog tables contain metadata about data tables in Amazon S3, JDBC data sources, Amazon Redshift, streaming sources, and other data stores. This enables users to run queries and ETL jobs that can join and query data across multiple accounts. For more information, see [Sharing Data Catalog Tables and Databases Across AWS Accounts](https://docs.aws.amazon.com/lake-formation/latest/dg/sharing-catalog-resources.html) in the _AWS Lake Formation Developer Guide_. | No | Yes Can share with **any** AWS account. | No | No @@ -201 +209 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Marketplace Catalog Entity `aws-marketplace:Entity` | Create, manage, and share entities across AWS accounts or in your organization in AWS Marketplace. For more information, see [Resource sharing in AWS RAM](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/resource-sharing.html) in the _AWS Marketplace Catalog API Reference_. | Yes | Yes Can share with **any** AWS account. | No | No +Marketplace Catalog Entities `aws-marketplace:Entity` | Create, manage, and share entities across AWS accounts or in your organization in AWS Marketplace. For more information, see [Resource sharing in AWS RAM](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/resource-sharing.html) in the _AWS Marketplace Catalog API Reference_. | Yes | Yes Can share with **any** AWS account. | No | No @@ -217 +225 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Approval team `mpa:ApprovalTeam` | Create and manage approval teams and share them with other AWS accounts or your organization. This allows other AWS accounts to use an approval team associated with a protected operation. A protected operation is a predefined list of operations that require team approval before it can be executed. For more information, see [Terms and Concepts](https://docs.aws.amazon.com/mpa/latest/userguide/mpa-concepts.html) in the _Multi-party approval User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Multi-Party Approval Team `mpa:ApprovalTeam` | Create and manage approval teams and share them with other AWS accounts or your organization. This allows other AWS accounts to use an approval team associated with a protected operation. A protected operation is a predefined list of operations that require team approval before it can be executed. For more information, see [Terms and Concepts](https://docs.aws.amazon.com/mpa/latest/userguide/mpa-concepts.html) in the _Multi-party approval User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -225,3 +233,3 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Firewall `network-firewall:Firewall` | Create and manage firewalls centrally, and share them with other AWS accounts so they can create firewall endpoints. This enables multiple accounts to use the protections of a single firewall. For more information, see [Sharing AWS Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the _AWS Network Firewall Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No -Firewall policies `network-firewall:FirewallPolicy` | Create and manage firewall policies centrally, and share them with other AWS accounts or your organization. This enables multiple accounts in an organization to share a common set of network monitoring, protection, and filtering behaviors. For more information, see [Sharing AWS Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the _AWS Network Firewall Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No -Rule groups `network-firewall:StatefulRuleGroup` `network-firewall:StatelessRuleGroup` | Create and manage stateless and stateful rule groups centrally, and share them with other AWS accounts or your organization. This enables multiple accounts in an organization in AWS Organizations to share a set of criteria for inspecting and handling network traffic. For more information, see [Sharing AWS Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the _AWS Network Firewall Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +Network Firewalls `network-firewall:Firewall` | Create and manage firewalls centrally, and share them with other AWS accounts so they can create firewall endpoints. This enables multiple accounts to use the protections of a single firewall. For more information, see [Sharing AWS Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the _AWS Network Firewall Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +Network Firewall Policies `network-firewall:FirewallPolicy` | Create and manage firewall policies centrally, and share them with other AWS accounts or your organization. This enables multiple accounts in an organization to share a common set of network monitoring, protection, and filtering behaviors. For more information, see [Sharing AWS Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the _AWS Network Firewall Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +Network Firewall Rule groups `network-firewall:StatefulRuleGroup` `network-firewall:StatelessRuleGroup` | Create and manage stateless and stateful rule groups centrally, and share them with other AWS accounts or your organization. This enables multiple accounts in an organization in AWS Organizations to share a set of criteria for inspecting and handling network traffic. For more information, see [Sharing AWS Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the _AWS Network Firewall Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No @@ -245,2 +253,2 @@ Outposts `outposts:Outpost` | Create and manage Outposts centrally, and share t -Local gateway route table `ec2:LocalGatewayRouteTable` | Create and manage VPC associations to a local gateway centrally, and share them with other AWS accounts in your organization. This lets multiple accounts create VPC associations to a local gateway, and view route table and virtual interface configuration. For more information, see [Shareable Outpost resources](https://docs.aws.amazon.com/outposts/latest/userguide/sharing-outposts.html#sharing-resources) in the _AWS Outposts User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | No | No -Sites `outposts:Site` | Create and manage Outpost sites and share them with other AWS accounts in your organization. This lets multiple accounts create and manage Outposts at the shared site and supports split control between the Outpost resources and the site. For more information, see [ Working with shared AWS Outposts resources](https://docs.aws.amazon.com/outposts/latest/userguide/sharing-outposts.html) in the _AWS Outposts User Guide_. | No | Yes Can share with **any** AWS account. | No | No +Local gateway route tables `ec2:LocalGatewayRouteTable` | Create and manage VPC associations to a local gateway centrally, and share them with other AWS accounts in your organization. This lets multiple accounts create VPC associations to a local gateway, and view route table and virtual interface configuration. For more information, see [Shareable Outpost resources](https://docs.aws.amazon.com/outposts/latest/userguide/sharing-outposts.html#sharing-resources) in the _AWS Outposts User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | No | No +Outposts Sites `outposts:Site` | Create and manage Outpost sites and share them with other AWS accounts in your organization. This lets multiple accounts create and manage Outposts at the shared site and supports split control between the Outpost resources and the site. For more information, see [ Working with shared AWS Outposts resources](https://docs.aws.amazon.com/outposts/latest/userguide/sharing-outposts.html) in the _AWS Outposts User Guide_. | No | Yes Can share with **any** AWS account. | No | No @@ -262 +270 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Private certificate authority (CA) `acm-pca:CertificateAuthority` | Create and manage private certificate authorities (CAs) for your organization’s internal public key infrastructure (PKI), and share those CAs with other AWS accounts or your organization. This lets AWS Certificate Manager users in other accounts issue X.509 certificates signed by your shared CA. For more information, see [Controlling access to a private CA](https://docs.aws.amazon.com/acm-pca/latest/userguide/granting-ca-access.html) in the _AWS Private Certificate Authority User Guide_. | Yes | Yes Can share with **any** AWS account. | No | Yes +Private certificate authority (CAs) `acm-pca:CertificateAuthority` | Create and manage private certificate authorities (CAs) for your organization’s internal public key infrastructure (PKI), and share those CAs with other AWS accounts or your organization. This lets AWS Certificate Manager users in other accounts issue X.509 certificates signed by your shared CA. For more information, see [Controlling access to a private CA](https://docs.aws.amazon.com/acm-pca/latest/userguide/granting-ca-access.html) in the _AWS Private Certificate Authority User Guide_. | Yes | Yes Can share with **any** AWS account. | No | Yes @@ -270 +278 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Views `resource-explorer-2:View` | Create and configure Resource Explorer views centrally, and share them with other AWS accounts in your organization. This lets roles and users in multiple AWS accounts search for and discover the resources accessible through the view. For more information, see [Sharing Resource Explorer views](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-views-share.html) in the _AWS Resource Explorer User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | No | No +Resource Explorer Views `resource-explorer-2:View` | Create and configure Resource Explorer views centrally, and share them with other AWS accounts in your organization. This lets roles and users in multiple AWS accounts search for and discover the resources accessible through the view. For more information, see [Sharing Resource Explorer views](https://docs.aws.amazon.com/resource-explorer/latest/userguide/manage-views-share.html) in the _AWS Resource Explorer User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | No | No @@ -286 +294 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Route 53 Resolver DNS Firewall rule groups `route53resolver:FirewallRuleGroup` | Create and manage Route 53 Resolver DNS Firewall rule groups centrally, and share them with other AWS accounts or your organization. This enables multiple accounts to share a set of criteria for inspecting and handling outbound DNS queries that go through Route 53 Resolver. For more information, see [Sharing Route 53 Resolver DNS Firewall rule groups between AWS accounts](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-rule-group-sharing.html) in the _Amazon Route 53 Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +Route 53 Resolver Firewall rule groups `route53resolver:FirewallRuleGroup` | Create and manage Route 53 Resolver DNS Firewall rule groups centrally, and share them with other AWS accounts or your organization. This enables multiple accounts to share a set of criteria for inspecting and handling outbound DNS queries that go through Route 53 Resolver. For more information, see [Sharing Route 53 Resolver DNS Firewall rule groups between AWS accounts](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-rule-group-sharing.html) in the _Amazon Route 53 Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No @@ -289 +297 @@ Resolver rules `route53resolver:ResolverRule` | Create and manage Resolver rule -Query logs `route53resolver:ResolverQueryLogConfig` | Create and manage query logs centrally, and share them with other AWS accounts or your organization. This enables multiple AWS accounts to log DNS queries that originate in their VPCs to a centrally managed query log. For more information, see [ Sharing Resolver query logging configurations with other AWS accounts](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logging-configurations-managing-sharing.html) in the _Amazon Route 53 Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Resolver Query Logging Configurations `route53resolver:ResolverQueryLogConfig` | Create and manage query logs centrally, and share them with other AWS accounts or your organization. This enables multiple AWS accounts to log DNS queries that originate in their VPCs to a centrally managed query log. For more information, see [ Sharing Resolver query logging configurations with other AWS accounts](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/query-logging-configurations-managing-sharing.html) in the _Amazon Route 53 Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -297 +305 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Access Grants `s3:AccessGrants` | Create and manage S3 Access Grants Instance centrally, and share them with other AWS accounts or your organization. This lets multiple accounts view and delete shared resources. For more information, see [ S3 Access Grants Cross-account Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-cross-accounts.html) in the _Amazon Simple Storage Service User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | Yes +S3 Access Grants `s3:AccessGrants` | Create and manage S3 Access Grants Instance centrally, and share them with other AWS accounts or your organization. This lets multiple accounts view and delete shared resources. For more information, see [ S3 Access Grants Cross-account Access](https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-grants-cross-accounts.html) in the _Amazon Simple Storage Service User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | Yes @@ -305 +313 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -SageMaker AI Catalog `sagemaker:SagemakerCatalog` | For **discoverability** – allows account owners to grant discoverability permissions to other accounts, for all feature group resources in the SageMaker AI catalog. Once granted access, users of those accounts can view the feature groups that have been shared with them from the catalog. For more information, see [ Cross-account feature group discoverability and access](https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-cross-account.html) in the _Amazon SageMaker AI Developer Guide_. +SageMaker AI Resource Catalogs `sagemaker:SagemakerCatalog` | For **discoverability** – allows account owners to grant discoverability permissions to other accounts, for all feature group resources in the SageMaker AI catalog. Once granted access, users of those accounts can view the feature groups that have been shared with them from the catalog. For more information, see [ Cross-account feature group discoverability and access](https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-cross-account.html) in the _Amazon SageMaker AI Developer Guide_. @@ -310 +318 @@ Discoverability and access are separate permissions in SageMaker AI. | No | Y -SageMaker AI Feature group `sagemaker:FeatureGroup` | For **access** – allows account owners to grant access permissions to other accounts, for select feature group resources. Once granted access, users of those accounts can use the feature groups that have been shared with them. For more information, see [ Cross-account feature group discoverability and access](https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-cross-account.html) in the _Amazon SageMaker AI Developer Guide_. +SageMaker AI Feature groups `sagemaker:FeatureGroup` | For **access** – allows account owners to grant access permissions to other accounts, for select feature group resources. Once granted access, users of those accounts can use the feature groups that have been shared with them. For more information, see [ Cross-account feature group discoverability and access](https://docs.aws.amazon.com/sagemaker/latest/dg/feature-store-cross-account.html) in the _Amazon SageMaker AI Developer Guide_. @@ -315,2 +323,2 @@ Discoverability and access are separate permissions in SageMaker AI. | Yes | -SageMaker AI JumpStart `sagemaker:Hub` | With Amazon SageMaker AI JumpStart, you can create and manage `sagemaker:Hub` centrally, and share them with other AWS accounts in the same organization. For more information, see [Control foundation model access using private curated hubs in Amazon SageMaker AI JumpStart](https://docs.aws.amazon.com/sagemaker/latest/dg/jumpstart-curated-hubs.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -Lineage group `sagemaker:LineageGroup` | Amazon SageMaker AI lets you create lineage groups of your pipeline metadata to get a deeper understanding of its history and relationships. Share the lineage group with other AWS accounts or the accounts in your organization. This lets multiple AWS accounts and users view information about the lineage group and query the tracking entities within it. For more information, see [Cross-Account Lineage Tracking](https://docs.aws.amazon.com/sagemaker/latest/dg/xaccount-lineage-tracking.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +SageMaker AI Hubs `sagemaker:Hub` | With Amazon SageMaker AI JumpStart, you can create and manage `sagemaker:Hub` centrally, and share them with other AWS accounts in the same organization. For more information, see [Control foundation model access using private curated hubs in Amazon SageMaker AI JumpStart](https://docs.aws.amazon.com/sagemaker/latest/dg/jumpstart-curated-hubs.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +SageMaker AI Lineage groups `sagemaker:LineageGroup` | Amazon SageMaker AI lets you create lineage groups of your pipeline metadata to get a deeper understanding of its history and relationships. Share the lineage group with other AWS accounts or the accounts in your organization. This lets multiple AWS accounts and users view information about the lineage group and query the tracking entities within it. For more information, see [Cross-Account Lineage Tracking](https://docs.aws.amazon.com/sagemaker/latest/dg/xaccount-lineage-tracking.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No @@ -318,3 +326,3 @@ SageMaker AI Model Cards `sagemaker:ModelCard` | Amazon SageMaker AI creates Mo -SageMaker AI Model Registry Model Package Group `sagemaker:model-package-group` | With Amazon SageMaker AI Model Registry, you can create and manage `sagemaker:model-package-group` centrally, and share them with other AWS accounts to register model versions. For more information, see [Amazon SageMaker AI Model Registry](https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-ram.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes | Yes | No -SageMaker AI Partner Apps `sagemaker:PartnerApp` | With SageMaker AI Partner AI Apps, you can create and manage SageMaker AI Partner AI Apps centrally, and share access to them with other AWS accounts. | Yes | Yes Can share with **any** AWS account. | No | No -SageMaker AI pipeline `sagemaker:Pipeline` | With Amazon SageMaker AI Model Building Pipelines, you can create, automate, and manage end-to-end machine learning workflows at scale. Share your pipelines with other AWS accounts or the accounts in your organization to achieve a multi-account strategy for your machine learning operations. This lets multiple AWS accounts and users view information about a pipeline and its executions with optional access to start, stop, and retry pipelines from other accounts. For more information, see [Cross-Account Support for SageMaker AI Pipelines](https://docs.aws.amazon.com/sagemaker/latest/dg/build-and-manage-xaccount.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +SageMaker AI Model package groups `sagemaker:model-package-group` | With Amazon SageMaker AI Model Registry, you can create and manage `sagemaker:model-package-group` centrally, and share them with other AWS accounts to register model versions. For more information, see [Amazon SageMaker AI Model Registry](https://docs.aws.amazon.com/sagemaker/latest/dg/model-registry-ram.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes | Yes | No +SageMaker AI Partner Apps `sagemaker:PartnerApp` | With SageMaker AI Partner AI Apps, you can create and manage SageMaker AI Partner AI Apps centrally, and share access to them with other AWS accounts. For more information, see [Setting up cross-account sharing for Amazon SageMaker AI partner AI apps](https://docs.aws.amazon.com/sagemaker/latest/dg/partner-app-resource-sharing-ram.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +SageMaker AI pipelines `sagemaker:Pipeline` | With Amazon SageMaker AI Model Building Pipelines, you can create, automate, and manage end-to-end machine learning workflows at scale. Share your pipelines with other AWS accounts or the accounts in your organization to achieve a multi-account strategy for your machine learning operations. This lets multiple AWS accounts and users view information about a pipeline and its executions with optional access to start, stop, and retry pipelines from other accounts. For more information, see [Cross-Account Support for SageMaker AI Pipelines](https://docs.aws.amazon.com/sagemaker/latest/dg/build-and-manage-xaccount.html) in the _Amazon SageMaker AI Developer Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -328,2 +336,2 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Application `servicecatalog:Applications` | Create an application, and use it to track the resources belonging to that application throughout your AWS environment. Share the application with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the application and associated resources with it locally. For more information, see [Creating applications](https://docs.aws.amazon.com/servicecatalog/latest/arguide/create-apps.html) in the _Service Catalog User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | Yes | No -Attribute Group `servicecatalog:AttributeGroups` | Create an attribute group, and use it to store meta-data relating to your applications. Share the attribute groups with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the attribute groups. For more information, see [Creating attribute groups](https://docs.aws.amazon.com/servicecatalog/latest/arguide/associate-attributes.html) in the _Service Catalog User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | Yes | No +AppRegistry Applications `servicecatalog:Applications` | Create an application, and use it to track the resources belonging to that application throughout your AWS environment. Share the application with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the application and associated resources with it locally. For more information, see [Creating applications](https://docs.aws.amazon.com/servicecatalog/latest/arguide/create-apps.html) in the _Service Catalog User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | Yes | No +AppRegistry Attribute Groups `servicecatalog:AttributeGroups` | Create an attribute group, and use it to store meta-data relating to your applications. Share the attribute groups with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the attribute groups. For more information, see [Creating attribute groups](https://docs.aws.amazon.com/servicecatalog/latest/arguide/associate-attributes.html) in the _Service Catalog User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | Yes | No @@ -337 +345 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Contacts `ssm-contacts:Contact` | Create and manage contacts and escalation plans centrally, and share the contact details with other AWS accounts or your organization. This lets many AWS accounts view engagements occurring during an incident. +Incident Manager Contacts `ssm-contacts:Contact` | Create and manage contacts and escalation plans centrally, and share the contact details with other AWS accounts or your organization. This lets many AWS accounts view engagements occurring during an incident. @@ -342 +350 @@ Currently, the ability to add a contact that's shared from another account to an -Response plans `ssm-incidents:ResponsePlan` | Create and manage response plans centrally, and share them with other AWS accounts or your organization. This lets those AWS accounts connect Amazon CloudWatch alarms and Amazon EventBridge event rules to response plans, automatically creating an incident when it’s detected. The incident also has access to the metrics of these other AWS accounts. For more information, see [Working with shared contacts and response plans](https://docs.aws.amazon.com/incident-manager/latest/userguide/sharing.html) in the _AWS Systems Manager Incident Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Incident Manager Response plans `ssm-incidents:ResponsePlan` | Create and manage response plans centrally, and share them with other AWS accounts or your organization. This lets those AWS accounts connect Amazon CloudWatch alarms and Amazon EventBridge event rules to response plans, automatically creating an incident when it’s detected. The incident also has access to the metrics of these other AWS accounts. For more information, see [Working with shared contacts and response plans](https://docs.aws.amazon.com/incident-manager/latest/userguide/sharing.html) in the _AWS Systems Manager Incident Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -350,2 +358,2 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Deny-access policy `ssm:Document` | Create an approval policy for just-in-time node access with Systems Manager. A deny-access policy explicitly prevents the auto-approval of access requests to the nodes you specify. Share the deny-access policy with other AWS accounts or your organization. This ensures your deny-access policy for just-in-time node access applies to all accounts in your organization. For more information, see [Just-in-time node access using Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-just-in-time-node-access.html) in the _AWS Systems Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -Parameter `ssm:Parameter` | Create a parameter, and use it to store configuration data that you can reference in your scripts, commands, SSM documents, and configuration and automation workflows. Share the parameter with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the string and improve security by separating your data from your code. For more information, see [Working with shared parameters](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-shared-parameters.html) in the _AWS Systems Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +SSM JITNA Auto-Deny policies `ssm:Document` | Create an approval policy for just-in-time node access with Systems Manager. A deny-access policy explicitly prevents the auto-approval of access requests to the nodes you specify. Share the deny-access policy with other AWS accounts or your organization. This ensures your deny-access policy for just-in-time node access applies to all accounts in your organization. For more information, see [Just-in-time node access using Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-just-in-time-node-access.html) in the _AWS Systems Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +Parameter Store Advanced Parameters `ssm:Parameter` | Create a parameter, and use it to store configuration data that you can reference in your scripts, commands, SSM documents, and configuration and automation workflows. Share the parameter with other AWS accounts or your organization. This lets multiple AWS accounts and users view information about the string and improve security by separating your data from your code. For more information, see [Working with shared parameters](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-shared-parameters.html) in the _AWS Systems Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No @@ -359,3 +367,3 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Customer-owned IPv4 addresses `ec2:CoipPool` | During the AWS Outposts installation process, AWS creates an address pool, known as a _customer-owned IP address pool_ , based on information that you provide about your on-premises network. Customer-owned IP addresses provide local, or external connectivity to resources in your Outposts subnets through your on-premises network. You can assign these addresses to resources on your Outpost, such as EC2 instances, using Elastic IP addresses or using the subnet setting that automatically assigns customer-owned IP addresses. For more information, see [Customer-owned IP addresses](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#ip-addressing) in the _AWS Outposts User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | No | No -IP Address Manager (IPAM) pools `ec2:IpamPool` | Share Amazon VPC IPAM pools centrally with other AWS accounts, IAM roles or users, or an entire organization or organizational unit (OU) in AWS Organizations. This lets those principals allocate CIDRs from the pool to AWS resources, such as VPCs, in their respective accounts. For more information, see [Share an IPAM pool using AWS RAM](https://docs.aws.amazon.com/vpc/latest/ipam/share-pool-ipam.html) in the _Amazon VPC IP Address Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No -IP Address Manager (IPAM) resource discoveries `ec2:IpamResourceDiscovery` | Share resource discoveries with other AWS accounts. A resource discovery is an Amazon VPC IPAM component that enables IPAM to manage and monitor resources that belong to the owning account. For more information, see [Work with resource discoveries](https://docs.aws.amazon.com/vpc/latest/ipam/res-disc-ipam.html) in the _Amazon VPC IPAM User Guide_. | No | Yes Can share with **any** AWS account. | No | No +Customer-owned IPv4pool `ec2:CoipPool` | During the AWS Outposts installation process, AWS creates an address pool, known as a _customer-owned IP address pool_ , based on information that you provide about your on-premises network. Customer-owned IP addresses provide local, or external connectivity to resources in your Outposts subnets through your on-premises network. You can assign these addresses to resources on your Outpost, such as EC2 instances, using Elastic IP addresses or using the subnet setting that automatically assigns customer-owned IP addresses. For more information, see [Customer-owned IP addresses](https://docs.aws.amazon.com/outposts/latest/userguide/outposts-networking-components.html#ip-addressing) in the _AWS Outposts User Guide_. | No | No Can share with **only** AWS accounts in its own organization. | No | No +IPAM pools `ec2:IpamPool` | Share Amazon VPC IPAM pools centrally with other AWS accounts, IAM roles or users, or an entire organization or organizational unit (OU) in AWS Organizations. This lets those principals allocate CIDRs from the pool to AWS resources, such as VPCs, in their respective accounts. For more information, see [Share an IPAM pool using AWS RAM](https://docs.aws.amazon.com/vpc/latest/ipam/share-pool-ipam.html) in the _Amazon VPC IP Address Manager User Guide_. | Yes | Yes Can share with **any** AWS account. | Yes | No +IPAM resource discoveries `ec2:IpamResourceDiscovery` | Share resource discoveries with other AWS accounts. A resource discovery is an Amazon VPC IPAM component that enables IPAM to manage and monitor resources that belong to the owning account. For more information, see [Work with resource discoveries](https://docs.aws.amazon.com/vpc/latest/ipam/res-disc-ipam.html) in the _Amazon VPC IPAM User Guide_. | No | Yes Can share with **any** AWS account. | No | No @@ -376 +384 @@ Transit gateway multicast domains `ec2:TransitGatewayMulticastDomain` | Create a -AWS Verified Access group `ec2:VerifiedAccessGroup` | Create and manage AWS Verified Access groups centrally, and then share them with other AWS accounts or your organization. This lets applications in multiple accounts use a single, shared set of AWS Verified Access endpoints. For more information, see [Share your AWS Verified Access group through AWS Resource Access Manager](https://docs.aws.amazon.com/verified-access/latest/ug/getting-started.html#getting-started-step5) in the _AWS Verified Access User Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +AWS Verified Access groups `ec2:VerifiedAccessGroup` | Create and manage AWS Verified Access groups centrally, and then share them with other AWS accounts or your organization. This lets applications in multiple accounts use a single, shared set of AWS Verified Access endpoints. For more information, see [Share your AWS Verified Access group through AWS Resource Access Manager](https://docs.aws.amazon.com/verified-access/latest/ug/getting-started.html#getting-started-step5) in the _AWS Verified Access User Guide_. | Yes | Yes Can share with **any** AWS account. | No | No @@ -385 +393 @@ Amazon VPC Lattice resource configuration `vpc-lattice:ResourceConfiguration` | -Amazon VPC Lattice service `vpc-lattice:Service` | Create and manage Amazon VPC Lattice services centrally, and share them with individual AWS accounts or your organization. This allows service owners to connect, secure, and observe service-to-service communication in a multi-account environment. For more information, see [Working with shared resources](https://docs.aws.amazon.com/vpc-lattice/latest/ug/sharing.html) in the _VPC Lattice User Guide_. | No | Yes Can share with **any** AWS account. | Yes | No +Amazon VPC Lattice services `vpc-lattice:Service` | Create and manage Amazon VPC Lattice services centrally, and share them with individual AWS accounts or your organization. This allows service owners to connect, secure, and observe service-to-service communication in a multi-account environment. For more information, see [Working with shared resources](https://docs.aws.amazon.com/vpc-lattice/latest/ug/sharing.html) in the _VPC Lattice User Guide_. | No | Yes Can share with **any** AWS account. | Yes | No @@ -394 +402 @@ Resource type and code | Use case | Can share with IAM users and roles | Can sha -Cloud WAN core network `networkmanager:CoreNetwork` | Create and manage a Cloud WAN core network centrally, and share it with other AWS accounts. This lets multiple AWS accounts access and provision hosts on a single Cloud WAN core network. For more information, see [Share a core network](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-share-network.html) in the _AWS Cloud WAN User Guide_. | Yes | Yes Can share with **any** AWS account. | No | No +Core networks `networkmanager:CoreNetwork` | Create and manage a Cloud WAN core network centrally, and share it with other AWS accounts. This lets multiple AWS accounts access and provision hosts on a single Cloud WAN core network. For more information, see [Share a core network](https://docs.aws.amazon.com/vpc/latest/cloudwan/cloudwan-share-network.html) in the _AWS Cloud WAN User Guide_. | Yes | Yes Can share with **any** AWS account. | No | No