AWS RAM Share doesn't provide ability to add permissions

[cjbeckwith]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Attempting to perform an organizational resource share of Route53 Resolver Rule. It shares without issue across org when I utilize the console, including showing up in the resolver ruleset in each account. However, it only shows up in the RAM share in the accounts when I utilize Terraform. The only difference I can see is when I go through the "wizard" in the console, there are additional permissions (specifically the AWSRAMDefaultPermissionResolverRule permission which allows for the rule to be consumed by Route 53 Resolver). In reviewing what was created by Terraform, there are no policies associated with the rule when shared.

I need a means to associate this policy so that the rules are available for use in other accounts.

New or Affected Resource(s)

I would assume this would land in either:
aws_ram_principal_association
aws_ram_resource_share
or a new resource which applies the policy to the RAM resource.

Potential Terraform Configuration

resource "aws_ram_principal_association" "rule" {
  principal                  = data.aws_organizations_organization.company.arn
  resource_share_arn = aws_ram_resource_share.rule.arn
  policy                      = "AWSRAMDefaultPermissionResolverRule"
}

References

• #0000

[cjbeckwith]

Wanted to provide some additional color. AWS Powershell provides similar function see here. Note that their option in handling the permission is as follows:

PermissionArn <String[]>
The ARNs of the permissions to associate with the resource share. If you do not specify an ARN for the permission, AWS RAM automatically attaches the default version of the permission for each resource type.

[gdavison]

A new field permission_arns, list(string), should be added to aws_ram_resource_share, since ram.CreateResourceShareInput has the field PermissionArns.

This may be related to #17606

[github-actions]

This functionality has been released in v4.17.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.