← All articles

Advanced Cost‑Saving Strategy: Share AWS Resources Across Accounts

What advanced cost‑optimization strategy do most teams overlook?

Most organizations focus on instance right‑sizing, reserved capacity, and storage cleanup, but they rarely examine duplicate infrastructure across multiple AWS accounts. When each team creates its own VPC, NAT gateway, or Transit Gateway, the same functionality is paid for multiple times. Sharing those network resources through AWS Resource Access Manager (RAM) can remove redundancy, simplify management, and shrink the monthly bill without sacrificing security or performance.

Why duplicate resources waste money

• VPC subnets – each subnet incurs a small hourly charge for the underlying network interface and data‑processing fees when used with NAT or Transit Gateways.
• NAT gateways – billed per hour and per GB processed. Deploying a NAT gateway in every account can multiply costs quickly.
• Transit Gateways – $0.05 per attachment‑hour plus data processing fees. Multiple accounts attaching their own TGW creates unnecessary expense.
• Route 53 Resolver rules – each inbound/outbound endpoint is billed per hour. Replicating the same DNS forwarding rules across accounts adds up.

When these resources are duplicated, the organization pays for the same capability multiple times. The savings from consolidating them can be substantial, especially in large enterprises with dozens of accounts.

Overview of AWS Resource Access Manager (RAM)

AWS RAM is a fully managed service that lets you share supported resources with other AWS accounts, organizational units (OUs), or the entire organization. Shared resources remain owned by the source account, but the recipient accounts can use them as if they were local. RAM supports:

• VPC subnets
• Transit Gateways and attachments
• Route 53 Resolver rules
• License Manager configurations
• Amazon Aurora global databases (in preview)

Because RAM works at the resource level, you keep the original security posture (security groups, NACLs, IAM policies) while eliminating the need to provision a parallel copy.

Identify candidate resources for sharing

Before you start sharing, inventory the network resources that are identical or functionally overlapping across accounts.

1. List VPC subnets that host identical CIDR blocks

aws ec2 describe-subnets \
  --query "Subnets[?CidrBlock=='10.0.0.0/16'].{SubnetId:SubnetId,AccountId:OwnerId,Region:AvailabilityZone}" \
  --output table

2. Find NAT gateways that have the same public IP address range

aws ec2 describe-nat-gateways \
  --query "NatGateways[?State=='available'].{NatGatewayId:NatGatewayId,SubnetId:SubnetId,AllocationId:AllocationId}" \
  --output table

3. Enumerate Transit Gateway attachments per account

aws ec2 describe-transit-gateway-attachments \
  --query "TransitGatewayAttachments[?State=='available'].{AttachmentId:TransitGatewayAttachmentId,ResourceId:ResourceId,ResourceType:ResourceType}" \
  --output table

4. List Route 53 Resolver inbound endpoints

aws route53resolver list-resolver-endpoints \
  --query "ResolverEndpoints[?Direction=='INBOUND'].{EndpointId:Id,IpAddressCount:IpAddressCount}" \
  --output table

Collect the output in a spreadsheet, group by function (e.g., "central internet egress" for NAT gateways) and note which accounts already have a functional duplicate.

Step‑by‑step: Enable RAM sharing across accounts

1. Set up AWS Organizations (if not already)

1. Sign in to the Management Account.
2. Open the AWS Organizations console at https://console.aws.amazon.com/organizations/.
3. Choose Create organization → Enable all features.
4. Invite existing accounts or create new member accounts.

Tip: Using an organization makes it easy to share resources with the entire OU instead of listing individual account IDs.

2. Create a resource share in the console

1. Open the RAM console: https://console.aws.amazon.com/ram/.
2. Click Create resource share.
3. Name the share (e.g., Central‑NAT‑Gateway).
4. Under Resources, click Add resources, select NAT gateways, and pick the NAT gateway you want to share.
5. Under Principals, choose Organizational unit or AWS account IDs that need access.
6. (Optional) Enable Allow external principals if you plan to share with accounts outside the organization.
7. Click Create resource share.

The selected NAT gateway now appears in the Shared with me view of each recipient account.

3. Use the AWS CLI to automate sharing

# Create a resource share
aws ram create-resource-share \
  --name "Shared-Transit-Gateway" \
  --resource-arns arn:aws:ec2:us-east-1:123456789012:transit-gateway/tgw-0a1b2c3d4e5f6g7h8 \
  --principals "arn:aws:organizations::123456789012:ou/o-abcde12345/ou-xyz12345" \
  --tags Key=Purpose,Value=CostOptimization

# Accept the share in a member account
aws ram accept-resource-share-invitation \
  --resource-share-invitation-arn arn:aws:ram:us-east-1:098765432109:resource-share-invitation/abcd1234-ef56-7890-abcd-1234567890ab

Repeat the process for subnets, Route 53 Resolver rules, or other supported resources.

Adjust IAM policies and monitoring

Sharing a resource does not automatically grant full permissions. You must adjust IAM policies in the recipient accounts to allow the required actions.

Example policy for using a shared NAT gateway

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateNatGateway",
        "ec2:DescribeNatGateways",
        "ec2:DeleteNatGateway"
      ],
      "Resource": "*"
    }
  ]
}

Monitoring shared‑resource usage

• CloudWatch metrics – NAT gateway BytesProcessed and PacketsProcessed are visible to all accounts with the share.
• Cost Explorer – Use Cost Allocation Tags (e.g., SharedResource=NatGateway) to attribute usage to the owning account.
• AWS Config – Enable a rule like resource-sharing-enabled to ensure no new duplicate resources are created.

Compare cost impact of shared vs duplicate resources

The table shows that consolidating a single network service across five accounts can cut the hourly charge by roughly 80 %, translating to hundreds or thousands of dollars per month depending on traffic volume.

Automate discovery and enforcement with IaC

CloudFormation example for a shared subnet

Resources:
  SharedSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: vpc-0a1b2c3d4e5f6g7h8
      CidrBlock: 10.0.0.0/24
      AvailabilityZone: us-east-1a
      Tags:
        - Key: Name
          Value: Shared-Subnet
        - Key: SharedResource
          Value: true
Outputs:
  SubnetId:
    Value: !Ref SharedSubnet
    Export:
      Name: SharedSubnetId

Deploy this stack in the owner account and then create a RAM share that exports the SubnetId. Recipient accounts can import the exported value via CloudFormation StackSets or Terraform data sources.

Terraform module for shared Transit Gateway

resource "aws_ec2_transit_gateway" "shared_tgw" {
  description = "Central TGW for all accounts"
  tags = {
    Name          = "SharedTGW"
    SharedResource = "true"
  }
}

resource "aws_ram_resource_share" "tgw_share" {
  name = "SharedTGW"
  resource_arns = [aws_ec2_transit_gateway.shared_tgw.arn]
  principals    = ["arn:aws:organizations::${data.aws_caller_identity.current.account_id}:organization/o-abcde12345"]
}

Deploy the module once, then reference the shared TGW ARN in other workspaces.

Frequently asked questions

How does sharing affect security?

Shared resources keep the original security groups, NACLs, and IAM policies of the owning account. Recipient accounts only gain usage rights, not ownership, so you can maintain strict control while still providing access.

Can I share resources across regions?

RAM currently supports sharing within the same region only. To centralize across regions, you must create separate shares per region and route traffic via inter‑region VPC peering or Transit Gateway inter‑region peering.

What happens if a shared resource is deleted?

If the owner deletes the resource, the share is automatically revoked and all dependent connections break. Implement an AWS Config rule to prevent accidental deletion of shared resources.

Is there a cost for using RAM itself?

RAM is a free service. You only pay for the underlying resource (e.g., NAT gateway, Transit Gateway) that you are sharing.

Key takeaways

• Duplicate network resources across accounts inflate hourly and data‑processing fees.
• AWS RAM lets you share VPC subnets, NAT gateways, Transit Gateways, and Route 53 Resolver rules without copying them.
• A systematic inventory (using aws ec2 describe-* commands) identifies candidates for sharing.
• Create a resource share in the console or via CLI, then adjust IAM policies and enable monitoring.
• Consolidating a single NAT gateway or Transit Gateway across five accounts can cut the hourly charge by ~80 %.
• Automate the pattern with CloudFormation or Terraform to keep the architecture repeatable.
• Use Cost Explorer tags to attribute the saved spend back to the owning account.

Ready to see how much you could save by eliminating idle or duplicated resources? Try our free AWS waste finder and start visualizing hidden spend. When you’re ready for automated, read‑only scans that report the dollar impact of idle and wasted resources, create a free account and let CloudBudgetMaster do the heavy lifting.

CloudBudgetMaster automates the discovery of idle and wasted AWS resources today by scanning your account in read‑only mode and reporting the dollar impact of each finding. Support for GCP, Azure, and Snowflake is coming soon.