CASE 89 · KARST · 2025
Sharing without IAM acrobatics.
A genomics research org shared a Transit Gateway, a Glue Catalog, and three private hosted zones across nineteen accounts. The setup worked but every share required custom cross-account IAM and the platform team owned every change. We replaced the bespoke sharing with AWS Resource Access Manager.
Genomics research
LANDING ZONE
2025
RESULTS
What changed, by the numbers.
CUSTOM CROSS-ACCT IAM POLICIES
−93%
NEW-SHARE TICKETS
−84%
SHARED RESOURCES
17
AUDIT TRAIL
CLOUDTRAIL
HOW IT WENT
The bespoke sharing model had grown one custom IAM policy at a time. Every cross-account share — "let team B see catalog A," "let team C resolve hostnames in zone D" — was a hand-crafted policy with brittle resource ARN patterns. Adding a new team was a three-day project.
RAM replaced the entire pattern. The platform team published the shared resources once; consumer accounts accepted shares with no further IAM dance. Identity Center permission sets controlled who could initiate accepts. CloudTrail captured the audit trail per share.
Custom cross-account IAM policy count dropped 93%. The platform team’s new-share ticket queue dropped 84%. Adding a new team is now a one-hour task instead of a three-day project.
RELATED · SAME DOMAIN
Other engagements in this space.
READY WHEN YOU ARE
Let's get your AWS bill (and architecture) in order.
The discovery call is free. You walk away with at least one concrete idea — even if we never work together.