@aws-cdk/aws-servicecatalog

AWS Service Catalog Construct Library

---

All classes with the Cfn prefix in this module (CFN Resources) are always stable and safe to use.

The APIs of higher level constructs in this module are experimental and under active development. They are subject to non-backward compatible changes or removal in any future version. These are not subject to the Semantic Versioning model and breaking changes will be announced in the release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

AWS Service Catalog enables organizations to create and manage catalogs of products for their end users that are approved for use on AWS.

Table Of Contents

• Portfolio
  • Granting access to a portfolio
  • Sharing a portfolio with another AWS account

The @aws-cdk/aws-servicecatalog package contains resources that enable users to automate governance and management of their AWS resources at scale.

import * as servicecatalog from '@aws-cdk/aws-servicecatalog';

Portfolio

AWS Service Catalog portfolios allow admins to manage products that their end users have access to. Using the CDK, a new portfolio can be created with the Portfolio construct:

new servicecatalog.Portfolio(this, 'MyFirstPortfolio', {
  displayName: 'MyFirstPortfolio',
  providerName: 'MyTeam',
});

You can also specify properties such as description and acceptLanguage to help better catalog and manage your portfolios.

new servicecatalog.Portfolio(this, 'MyFirstPortfolio', {
  displayName: 'MyFirstPortfolio',
  providerName: 'MyTeam',
  description: 'Portfolio for a project',
  acceptLanguage: servicecatalog.AcceptLanguage.EN,
});

Read more at Creating and Managing Portfolios.

A portfolio that has been created outside the stack can be imported into your CDK app. Portfolios can be imported by their ARN via the Portfolio.fromPortfolioArn() API:

const portfolio = servicecatalog.Portfolio.fromPortfolioArn(this, 'MyImportedPortfolio',
  'arn:aws:catalog:region:account-id:portfolio/port-abcdefghi');

Granting access to a portfolio

You can manage end user access to a portfolio by granting permissions to IAM entities like a user, group, or role. Once resources are deployed end users will be able to access them via the console or service catalog CLI.

import * as iam from '@aws-cdk/aws-iam';

const user = new iam.User(this, 'MyUser');
portfolio.giveAccessToUser(user);

const role = new iam.Role(this, 'MyRole', {
  assumedBy: new iam.AccountRootPrincipal(),
});
portfolio.giveAccessToRole(role);

const group = new iam.Group(this, 'MyGroup');
portfolio.giveAccessToGroup(group);

Sharing a portfolio with another AWS account

A portfolio can be programatically shared with other accounts so that specified users can also access it:

portfolio.shareWithAccount('012345678901');

Changelog

1.110.0 (2021-06-24)

⚠ BREAKING CHANGES TO EXPERIMENTAL FEATURES

• appmesh: static methods from TlsValidationTrust have been changed to accept positional arguments

• appmesh: static methods from TlsCertificate have been changed to accept positional arguments
• appmesh: the type TlsListener has been renamed to ListenerTlsOptions

Features

• appmesh: allow configuring mutual TLS (#15101) (e47a01f), closes /github.com/aws/aws-cdk/pull/14782#discussion_r636334863 #12733
• assertions: an initial version of the CDK 'assert' library, now experimentally available in all supported languages (#15173) (367fe7e)
• cli: read outputs-file parameter from cdk.json (#15095) (9e933ca), closes #14307
• cloudwatch: use string instead of any for cloudwatch dimension values (#15097) (dc3cf13), closes #14978
• codepipeline: allow granting manual approval permissions (#15102) (b2037d3)
• dynamodb: allow using Kinesis stream in Table (#15199) (7bc6c6e), closes #14534
• eks: taints for managed node groups (#14792) (0556e6b)
• events: allows importing event bus from name (#15087) (e39b6c5), closes #14072
• msk: IAM access control for clusters (#14647) (1fe680c)
• msk: use L2 ACM PCA in cluster authentication props (#15110) (aa86a24)
• pipelines: add pre-install commands to asset action (#15067) (f238779)
• s3: notifications to existing buckets (#15158) (7d218c2), closes #2004
• secretsmanager: automatically grant permissions to rotation Lambda (#14882) (ad283b6)
• servicecatalogappregistry: initial L2 construct for Application (#15140) (881737c)
• servicecatalogappregistry: Initial L2 construct for Attribute Group (#15282) (4330fe8)
• synthetics: support canary environment variables (#15082) (df9f13f), closes #10515 #9300

Bug Fixes

• amplify: deployment does not remove basic auth (#15243) (e5c0d59), closes #15028
• bootstrap: deploy-role could directly access buckets in target account (#15192) (d04e288), closes #12985 #14082 #13422
• cdk-assets: content type not correctly set when publishing files (#15069) (9b1a4f9)
• core: 1 hour renders as 60 minutes (#15125) (adcd8c3)
• core: parsing an ARN with a slash after a colon in the resource part fails (#15166) (16b8a4e), closes /github.com/aws/aws-cdk/pull/15140/files#r653112073
• elasticsearch: Domain.fromDomainAttributes gives "Invalid URL" when endpoint is a token (#15219) (ecb5af8), closes #15188
• lambda-nodejs: unstable asset hashes with bundling.nodeModules (#15229) (4b5418c), closes #15023
• servicecatalog: Portfolio fails validation when passed Tokens as its properties (#15208) (ce727c1)
• stepfunctions-tasks: checking for task token in EcsRunTask containerOverrides causes memory explosion (#15187) (af53798), closes #15124
• stepfunctions-tasks: instance type for SageMakerCreateTrainingJob cannot be specified dynamically through JSONPath (#15215) (9280d95), closes #11928