View a markdown version of this page

Create an AWS RAM resource share for your Image Builder resources - EC2 Image Builder
Option 1: Create a RAM resource shareOption 2: Apply a resource policy and promote to an existing resource share

Create an AWS RAM resource share for your Image Builder resources

To share an Image Builder component, image, or recipe, you must add it to an AWS Resource Access Manager resource share. The resource share specifies the resources to share and the consumers with whom they are shared.

The following options are available for sharing your resources.

Option 1: Create a RAM resource share

When you create a RAM resource share, you can share a component, image, or recipe that you own in a single step. Use one of the following methods to create your resource share:

  • Console

    To create your resource share using the AWS RAM console, see Share AWS resources owned by you in the AWS RAM User Guide.

  • AWS CLI

    To create your resource share using the AWS RAM command line interface, run the create-resource-share command in the AWS CLI.

  • PowerShell

    To create your resource share using AWS Tools for PowerShell, run the New-RAMResourceShare cmdlet from the AWS.Tools.RAM module.

Option 2: Apply a resource policy and promote to an existing resource share

The second option for sharing your resources involves two steps, running commands in the AWS CLI or AWS Tools for PowerShell for both. The first step uses Image Builder commands to apply resource-based policies to the shared resource. The second step promotes the resource to a RAM resource share, so that the resource is visible to all principals with whom you've shared it.

  1. Apply the resource policy

    To successfully apply the resource policy, you must make sure that the account that you share with has permission to access any underlying resources.

    For each resource type that you can share, choose the tab for the tool that you use.

    In the PowerShell examples, each cmdlet takes the Amazon Resource Name (ARN) of the resource and the policy document. The Policy parameter takes the policy JSON as a string. Each example stores the policy in the $policy variable as a single-quoted here-string.

    Image

    You can apply a resource policy to an image, to allow others to use it as the base image in their recipes.

    AWS CLI

    To identify the AWS principals to share the image with, run the put-image-policy Image Builder command in the AWS CLI:

    aws imagebuilder put-image-policy \
    --image-arn arn:aws:imagebuilder:us-west-2:111122223333:image/my-example-image/2019.12.03/1 \
    --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetImage",
                "imagebuilder:ListImages"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:image/my-example-image/2019.12.03/1"
            ]
        }
    ]
}'
    PowerShell

    To identify the AWS principals to share the image with, run the Write-EC2IBImagePolicy cmdlet:

    $policy = @'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetImage",
                "imagebuilder:ListImages"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:image/my-example-image/2019.12.03/1"
            ]
        }
    ]
}
'@
Write-EC2IBImagePolicy -ImageArn arn:aws:imagebuilder:us-west-2:111122223333:image/my-example-image/2019.12.03/1 `
    -Policy $policy
    Component

    You can apply a resource policy to a build or test component to enable cross-account sharing. This policy gives other accounts permission to use your component in their recipes. The account that you share with must have permission to access any resources that the component references. For example, the component might reference files in private repositories.

    AWS CLI

    To identify the AWS principals to share the component with, run the put-component-policy Image Builder command in the AWS CLI:

    aws imagebuilder put-component-policy \
    --component-arn arn:aws:imagebuilder:us-west-2:111122223333:component/my-example-component/2019.12.03/1 \
    --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetComponent",
                "imagebuilder:ListComponents"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:component/my-example-component/2019.12.03/1"
            ]
        }
    ]
}'
    PowerShell

    To identify the AWS principals to share the component with, run the Write-EC2IBComponentPolicy cmdlet:

    $policy = @'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetComponent",
                "imagebuilder:ListComponents"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:component/my-example-component/2019.12.03/1"
            ]
        }
    ]
}
'@
Write-EC2IBComponentPolicy -ComponentArn arn:aws:imagebuilder:us-west-2:111122223333:component/my-example-component/2019.12.03/1 `
    -Policy $policy
    Image recipe

    You can apply a resource policy to an image recipe to enable cross-account sharing. This policy gives other accounts permission to use your recipe to create images in their accounts. The account that you share with must have permission to access any resources that the recipe references. These can include the base image and the selected components.

    AWS CLI

    To identify the AWS principals to share the image recipe with, run the put-image-recipe-policy Image Builder command in the AWS CLI:

    aws imagebuilder put-image-recipe-policy \
    --image-recipe-arn arn:aws:imagebuilder:us-west-2:111122223333:image-recipe/my-example-image-recipe/2019.12.03 \
    --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetImageRecipe",
                "imagebuilder:ListImageRecipes"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:image-recipe/my-example-image-recipe/2019.12.03"
            ]
        }
    ]
}'
    PowerShell

    To identify the AWS principals to share the image recipe with, run the Write-EC2IBImageRecipePolicy cmdlet:

    $policy = @'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetImageRecipe",
                "imagebuilder:ListImageRecipes"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:image-recipe/my-example-image-recipe/2019.12.03"
            ]
        }
    ]
}
'@
Write-EC2IBImageRecipePolicy -ImageRecipeArn arn:aws:imagebuilder:us-west-2:111122223333:image-recipe/my-example-image-recipe/2019.12.03 `
    -Policy $policy
    Container recipe

    You can apply a resource policy to a container recipe to enable cross-account sharing. This policy gives other accounts permission to use your recipe to create images in their accounts. The account that you share with must have permission to access any resources that the recipe references. These can include the base image and the selected components.

    AWS CLI

    To identify the AWS principals to share the container recipe with, run the put-container-recipe-policy Image Builder command in the AWS CLI:

    aws imagebuilder put-container-recipe-policy \
    --container-recipe-arn arn:aws:imagebuilder:us-west-2:111122223333:container-recipe/my-example-container-recipe/2021.12.03 \
    --policy '{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetContainerRecipe",
                "imagebuilder:ListContainerRecipes"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:container-recipe/my-example-container-recipe/2021.12.03"
            ]
        }
    ]
}'
    PowerShell

    To identify the AWS principals to share the container recipe with, run the Write-EC2IBContainerRecipePolicy cmdlet:

    $policy = @'
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "444455556666"
                ]
            },
            "Action": [
                "imagebuilder:GetContainerRecipe",
                "imagebuilder:ListContainerRecipes"
            ],
            "Resource": [
                "arn:aws:imagebuilder:us-west-2:111122223333:container-recipe/my-example-container-recipe/2021.12.03"
            ]
        }
    ]
}
'@
Write-EC2IBContainerRecipePolicy -ContainerRecipeArn arn:aws:imagebuilder:us-west-2:111122223333:container-recipe/my-example-container-recipe/2021.12.03 `
    -Policy $policy
    Note

    To set the correct policies for sharing and unsharing a resource, the resource owner must have imagebuilder:put* permissions.

  2. Promote as a RAM resource share

    To make the resource visible to all principals that you shared it with, run the promote-resource-share-created-from-policy AWS RAM command in the AWS CLI.

    To promote the resource share with AWS Tools for PowerShell, run the Convert-RAMPolicyBasedResourceShareToPromoted cmdlet from the AWS.Tools.RAM module.