@aws-cdk/aws-servicecatalog

AWS Service Catalog Construct Library

---

All classes with the Cfn prefix in this module (CFN Resources) are always stable and safe to use.

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

AWS Service Catalog enables organizations to create and manage catalogs of products for their end users that are approved for use on AWS.

Table Of Contents

• Portfolio
  • Granting access to a portfolio
  • Sharing a portfolio with another AWS account

The @aws-cdk/aws-servicecatalog package contains resources that enable users to automate governance and management of their AWS resources at scale.

import * as servicecatalog from '@aws-cdk/aws-servicecatalog';

Portfolio

AWS Service Catalog portfolios allow admins to manage products that their end users have access to. Using the CDK, a new portfolio can be created with the Portfolio construct:

new servicecatalog.Portfolio(this, 'MyFirstPortfolio', {
  displayName: 'MyFirstPortfolio',
  providerName: 'MyTeam',
});

You can also specify properties such as description and acceptLanguage to help better catalog and manage your portfolios.

new servicecatalog.Portfolio(this, 'MyFirstPortfolio', {
  displayName: 'MyFirstPortfolio',
  providerName: 'MyTeam',
  description: 'Portfolio for a project',
  acceptLanguage: servicecatalog.AcceptLanguage.EN,
});

Read more at Creating and Managing Portfolios.

A portfolio that has been created outside the stack can be imported into your CDK app. Portfolios can be imported by their ARN via the Portfolio.fromPortfolioArn() API:

const portfolio = servicecatalog.Portfolio.fromPortfolioArn(this, 'MyImportedPortfolio',
  'arn:aws:catalog:region:account-id:portfolio/port-abcdefghi');

Granting access to a portfolio

You can manage end user access to a portfolio by granting permissions to IAM entities like a user, group, or role. Once resources are deployed end users will be able to access them via the console or service catalog CLI.

import * as iam from '@aws-cdk/aws-iam';

const user = new iam.User(this, 'MyUser');
portfolio.giveAccessToUser(user);

const role = new iam.Role(this, 'MyRole', {
  assumedBy: new iam.AccountRootPrincipal(),
});
portfolio.giveAccessToRole(role);

const group = new iam.Group(this, 'MyGroup');
portfolio.giveAccessToGroup(group);

Sharing a portfolio with another AWS account

A portfolio can be programatically shared with other accounts so that specified users can also access it:

portfolio.shareWithAccount('012345678901');

Changelog

1.109.0 (2021-06-16)

Features

• apigateway: disable execute api endpoint (#14526) (b3a7d5b)
• aws-backup: Add arn attribute and grant method to backup vault (#14997) (04c0a07), closes #14996
• cfnspec: cloudformation spec v38.0.0 (#15044) (632d518)
• cfnspec: cloudformation spec v39.1.0 (#15144) (abc457e)
• cloudfront: add fromFile for CF functions (#14980) (31c9338), closes #14967
• codestarnotifications: new L2 constructs (#10833) (645ebe1), closes #9680
• core: allow user to provide docker --security-opt when bundling (#14682) (a418ea6)
• core: Support platform flag during asset build (#14908) (0189a9a)
• dynamodb: exposes schema method to return partition and sort key of table or secondary indexes (#15111) (1137eb7), closes #7680
• ecs-patterns: Add ability to configure VisibilityTimeout on QueueProcessing service pattern (#15052) (350d783)
• ecs-patterns: allow specifying security groups on ScheduledTask pattern (#15096) (6bdf1c0), closes #5213 #14220
• ecs-patterns: expose task target on ScheduledTask pattern (#15127) (c31c59a), closes #14971 #14953 #12609
• lambda-event-sources: streams - report batch item failures (#14458) (3d4a13e), closes #12654
• logs: make the addition of permissions to Lambda functions optional (#14222) (0c50ec9), closes #14198
• migration: add constructs migration to rewrite script (#14916) (37a4c8d)
• pipelines: add test commands to standard synth actions (#14979) (0bc8a8a)
• servicecatalog: initial implementation of the Portfolio construct (#15099) (203cc45)

Bug Fixes

• aws-iam: prevent adding duplicate resources and actions (#14712) (a8298cb), closes #13611
• cfn-include: NestedStack's Parameters are not converted to strings (#15098) (8ad33b8), closes #15092
• cli: cdk synth too eager with validation in Pipelines (#15147) (ae98e88), closes #14613 #15130
• cli: cdk synth doesn't output yaml for stacks with dependency stacks (#14805) (44feee6), closes #3721
• cli: deployment error traceback overwritten by progress bar (#14812) (d4a0af1), closes #14780
• cli: HTTP timeout is too low for some asset uploads (#13575) (23c58d6), closes #13183
• cli: option --all selects stacks in nested assemblies (#15046) (0d00e50)
• cli: partition is not being resolved at missing value lookup (#15146) (cc7191e), closes #15119
• cli: stack glob patterns only select one stack (#15071) (fcd2a6e)
• codebuild: Project's Role has permissions to the entire Bucket when using S3 as the source (#15112) (9d01b4f)
• codebuild: Secret env variable as token from another account fails on Key decryption (#14483) (91e80d7), closes #14477
• core: CloudFormation dynamic references can't be assigned to num… (#14913) (39aacc8), closes #14824
• ecs: TagParameterContainerImage cannot be used across accounts (#15073) (486f2e5), closes #15070
• kinesisanalytics-flink: set applicationName with L2 Application (#15060) (1de85f2), closes #15058
• lambda: deployment failure when layers are added to container functions (#15037) (8127cf2), closes #14143
• lambda-event-sources: kafka event source expects credentials even when accessed via vpc (#14804) (5eb1e75)
• pipelines: assets buildspec can exceed 25k size limit (#14974) (f7f367f)
• pipelines: PublishAssetsAction uses hard-coded role names (#15118) (bad9713)
• pipelines: self-update role assumes hard-coded role names (#14969) (cbd7552), closes #14877 #9271
• secretsmanager: support secrets rotation in partition 'aws-cn' (#14608) (5061a8d), closes #13385