How do I move a member account between AWS Organizations without interrupting AWS RAM resource sharing?

Short description

AWS RAM resource sharing works in two ways. The first shares resources with accounts inside your organization and activates automatically without an invitation or acceptance (referred to in this article as 1-way trust). The second sends an invitation to the target account and activates only after that account accepts it (referred to in this article as 2-way trust). A resource shared through 1-way trust is unshared the moment the consumer account leaves the organization.

To keep the RAM share itself intact while you move the account, create the RAM share with the RetainSharingOnAccountLeaveOrganization option, released on February 27, 2026. You set this option only when you create the resource share, and you can't modify it afterward.

Note : The terms 1-way trust and 2-way trust are used in this article to distinguish the two sharing behaviors. The AWS RAM documentation describes these as sharing within your organization (no invitation required) and sharing with accounts outside your organization (invitation acceptance required).

Note : Resources such as Transit Gateways and Prefix Lists continue to function for already-established connections even after the RAM share is removed. However, the AWS RAM console shows the share as removed.

Resolution

Understand the difference between 1-way trust and 2-way trust

When trusted access for the AWS RAM service is turned on in AWS Organizations, shares that target accounts inside your organization activate automatically without an invitation or acceptance. This is 1-way trust. Even when you specify an account ID inside your organization, the share operates as 1-way trust and activates within the organization without sending an invitation. A resource shared through 1-way trust is unshared the moment the account leaves the organization.

With 2-way trust, AWS RAM sends an invitation to the consumer account, and the share activates only after that account accepts the invitation. Because this share doesn't activate automatically within the organization, it remains intact regardless of the account move.

Complete the migration steps

Note : The RetainSharingOnAccountLeaveOrganization option is not available for resource types that can only be shared with an Organization.

1. Create a new RAM resource share for the target resources with the RetainSharingOnAccountLeaveOrganization option turned on. You can create multiple resource shares for the same resource, so create this one separately from the existing share.

   To create the share with AWS CLI version 2, run the following command.

   aws ram create-resource-share \
       --name RESOURCE_SHARE_NAME \
       --resource-arns RESOURCE_ARN \
       --principals CONSUMER_ACCOUNT_ID \
       --resource-share-configuration '{"retainSharingOnAccountLeaveOrganization": true}' \
       --region REGION

   In the command, replace RESOURCE_SHARE_NAME with a name for the share, RESOURCE_ARN with the ARN of the resource to share, CONSUMER_ACCOUNT_ID with the account ID that receives the share, and REGION with the AWS Region that contains the resource. For global resources, use us-east-1.

2. Note that turning on this option sends an invitation even for accounts inside your organization. In the consumer account, accept the invitation.

   To accept the invitation with AWS CLI version 2, first list the pending invitations to retrieve the invitation ARN, then accept it.

   aws ram get-resource-share-invitations --region REGION

   aws ram accept-resource-share-invitation \
       --resource-share-invitation-arn INVITATION_ARN \
       --region REGION

   In the commands, replace REGION with the AWS Region that contains the resource share, and INVITATION_ARN with the resourceShareInvitationArn value returned by the first command.

3. Move the consumer account to the destination organization.

4. Confirm that only the RAM share with RetainSharingOnAccountLeaveOrganization turned on remains in the consumer account. The existing 1-way trust share is unshared.

5. If you also move the account that shares the resources to the destination organization, create a new organization-level RAM resource share and remove the temporary RetainSharingOnAccountLeaveOrganization share that you created for the migration.

By following these steps, you move the account between organizations without interrupting any of the shared resources.

Related information

• Sharing your AWS resources
• CreateResourceShare API (RetainSharingOnAccountLeaveOrganization)
• Migrate an account to another organization with AWS Organizations
• Shareable AWS resources