If you’re trying to use the Resource Groups Tagging API to find tagged resources in your AWS account, you might run into some confusion when working with resources shared across accounts through AWS Resource Access Manager (RAM).
Here’s the simple truth: the GetResources operation in the API is designed to return resources that are tagged and accessible in your account. If a resource, like a VPC, is shared with you from another account using RAM, and you tag it from your side, the API will show that resource with an ARN (Amazon Resource Name) that appears to belong to your account, even though the actual owner is another account.
This happens because the API focuses on what your account can see and access, rather than the original account that owns the resource. So, when you query, the resource looks like it’s part of your account from the API’s point of view, even if it isn’t.
It is important to know that the official documentation doesn’t strongly mention how RAM-shared resources are handled specifically within GetResources or how their ARNs are formatted in cross-account sharing scenarios. The general guidance is that the API returns tagged resources in your account’s context, but details about shared resources are not explicitly clarified.
If you’re unsure whether this behavior is intentional or a bug, or if you’re looking for ways to manage shared resources more effectively, your best bet is to contact AWS Support. You can do this by opening a support case through the AWS Support Center. The team there can investigate your specific situation and provide clear guidance.
To do this, follow this link: AWS Support Center. Once you get in touch, explain that you’re working with RAM-shared resources and facing questions about their ARN display and retrieval through the GetResources API. Support will work with the service team to clarify whether what you’re experiencing is expected behavior and offer ideas on best practices moving forward.