AWS Resource Access Manager

1# yaml-language-server: $schema=../../schema/component.schema.json
2# AWS Resource Access Manager: resource shares that grant principals in other accounts, OUs or the
3# whole organization access to a resource you own, under a managed permission. "Sharing your AWS
4# resources": enabling sharing with AWS Organizations is an optional step that must be turned on
5# explicitly, a new resource share is created with "Allow sharing with anyone" selected
6# (allowExternalPrincipals true), sharing outside the organization requires the consumer to accept
7# an invitation that expires after 12 hours for most resource types, and RetainSharingOnAccountLeave
8# Organization is off so a consumer loses access when it leaves the organization.
9schemaVersion: "1"
10type: "component"
11id: "aws-ram"
12kind: "policy-engine"
13provider: "aws"
14docs: "https://docs.aws.amazon.com/ram/latest/userguide/what-is.html"
15defaults:
16  enforcementMode: "enforced"
17  scope: "account"
18  remediation: false
19  managed: true
20properties:
21  allowExternalPrincipals:
22    type: "boolean"
23    default: true
24  sharingWithOrganizationsEnabled:
25    type: "boolean"
26    default: false
27  managedPermissionType:
28    type: "enum"
29    values: ["aws-managed", "customer-managed"]
30    default: "aws-managed"
31  retainSharingOnAccountLeaveOrganization:
32    type: "boolean"
33    default: false
34  invitationExpiryHours:
35    type: "integer"
36    default: 12