You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat(servicecatalog): Service Catalog is now in Developer Preview (#19204)
Update some `README` documentation based on feedback.
Move library to developer preview with no anticipation of breaking changes.
----
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
You can manage end user access to a portfolio by granting permissions to `IAM` entities like a user, group, or role.
86
+
You can grant access to and manage the `IAM` users, groups, or roles that have access to the products within a portfolio.
87
+
Entities with granted access will be able to utilize the portfolios resources and products via the console or AWS CLI.
88
88
Once resources are deployed end users will be able to access them via the console or service catalog CLI.
89
89
90
90
```ts fixture=basic-portfolio
91
91
import*asiamfrom'@aws-cdk/aws-iam';
92
92
93
-
const user =newiam.User(this, 'MyUser');
93
+
const user =newiam.User(this, 'User');
94
94
portfolio.giveAccessToUser(user);
95
95
96
-
const role =newiam.Role(this, 'MyRole', {
96
+
const role =newiam.Role(this, 'Role', {
97
97
assumedBy: newiam.AccountRootPrincipal(),
98
98
});
99
99
portfolio.giveAccessToRole(role);
100
100
101
-
const group =newiam.Group(this, 'MyGroup');
101
+
const group =newiam.Group(this, 'Group');
102
102
portfolio.giveAccessToGroup(group);
103
103
```
104
104
105
105
### Sharing a portfolio with another AWS account
106
106
107
-
A portfolio can be programatically shared with other accounts so that specified users can also access it:
107
+
You can use account-to-account sharing to distribute a reference to your portfolio to other AWS accounts by passing the recipient account number.
108
+
After the share is initiated, the recipient account can accept the share via CLI or console by importing the portfolio ID.
109
+
Changes made to the shared portfolio will automatically propagate to recipients.
108
110
109
111
```ts fixture=basic-portfolio
110
112
portfolio.shareWithAccount('012345678901');
111
113
```
112
114
113
115
## Product
114
116
115
-
Products are the resources you are allowing end users to provision and utilize.
117
+
Products are version friendly infrastructure-as-code templates that admins create and add to portfolios for end users to provision and create AWS resources.
116
118
The CDK currently only supports adding products of type Cloudformation product.
117
119
Using the CDK, a new Product can be created with the `CloudFormationProduct` construct.
118
-
`CloudFormationTemplate.fromUrl`can be utilized to create a Product using a Cloudformation template directly from an URL:
120
+
You can use `CloudFormationTemplate.fromUrl` to create a Product from a CloudFormation template directly from a URL that points to the template in S3, GitHub, or CodeCommit:
@@ -190,21 +192,21 @@ const product = new servicecatalog.CloudFormationProduct(this, 'MyFirstProduct',
190
192
191
193
### Adding a product to a portfolio
192
194
193
-
You add products to a portfolio to manage your resources at scale. After adding a product to a portfolio,
194
-
it creates a portfolio-product association, and will become visible from the portfolio side in both the console and service catalog CLI.
195
-
A product can be added to multiple portfolios depending on your resource and organizational needs.
195
+
You add products to a portfolio to organize and distribute your catalog at scale. Adding a product to a portfolio creates an association,
196
+
and the product will become visible within the portfolio side in both the Service Catalog console and AWS CLI.
197
+
You can add a product to multiple portfolios depending on your organizational structure and how you would like to group access to products.
196
198
197
199
```ts fixture=portfolio-product
198
200
portfolio.addProduct(product);
199
201
```
200
202
201
203
## Tag Options
202
204
203
-
TagOptions allow administrators to easily manage tags on provisioned products by creating a selection of tags for end users to choose from.
204
-
TagOptions are created by specifying a tag key with a selection of allowed values and can be associated with both portfolios and products.
205
+
TagOptions allow administrators to easily manage tags on provisioned products by providing a template for a selection of tags that end users choose from.
206
+
TagOptions are created by specifying a tag key with a set of allowed values and can be associated with both portfolios and products.
205
207
When launching a product, both the TagOptions associated with the product and the containing portfolio are made available.
206
208
207
-
At the moment, TagOptions can only be disabled in the console.
209
+
At the moment, TagOptions can only be deactivated in the console.
Constraints define governance mechanisms that allow you to manage permissions, notifications, and options related to actions end users can perform on products,
229
-
Constraints are applied on a portfolio-product association.
230
+
Constraints are governance gestures that you place on product-portfolio associations that allow you to manage minimal launch permissions, notifications, and other optional actions that end users can perform on products.
230
231
Using the CDK, if you do not explicitly associate a product to a portfolio and add a constraint, it will automatically add an association for you.
231
232
232
-
There are rules around plurariliites of constraints for a portfolio and product.
233
-
For example, you can only have a single "tag update" constraint applied to a portfolio-product association.
233
+
There are rules around how constraints are applied to portfolio-product associations.
234
+
For example, you can only have a single "launch role" constraint applied to a portfolio-product association.
234
235
If a misconfigured constraint is added, `synth` will fail with an error message.
235
236
236
237
Read more at [Service Catalog Constraints](https://docs.aws.amazon.com/servicecatalog/latest/adminguide/constraints.html).
237
238
238
239
### Tag update constraint
239
240
240
241
Tag update constraints allow or disallow end users to update tags on resources associated with an AWS Service Catalog product upon provisioning.
241
-
By default, tag updating is not permitted.
242
+
By default, if a Tag Update constraint is not configured, tag updating is not permitted.
242
243
If tag updating is allowed, then new tags associated with the product or portfolio will be applied to provisioned resources during a provisioned product update.
Allows users to subscribe an AWS `SNS` topic to the stack events of the product.
262
-
When an end user provisions a product it creates a product stack that notifies the subscribed topic on creation, edit, and delete events.
263
-
An individual `SNS` topic may only be subscribed once to a portfolio-product association.
262
+
Allows users to subscribe an AWS `SNS` topic to a provisioned product's CloudFormation stack events.
263
+
When an end user provisions a product it creates a CloudFormation stack that notifies the subscribed topic on creation, edit, and delete events.
264
+
An individual `SNS` topic may only have a single subscription to any given portfolio-product association.
264
265
265
266
```ts fixture=portfolio-product
266
267
import*assnsfrom'@aws-cdk/aws-sns';
267
268
268
-
const topic1 =newsns.Topic(this, 'MyTopic1');
269
+
const topic1 =newsns.Topic(this, 'Topic1');
269
270
portfolio.notifyOnStackEvents(product, topic1);
270
271
271
-
const topic2 =newsns.Topic(this, 'MyTopic2');
272
+
const topic2 =newsns.Topic(this, 'Topic2');
272
273
portfolio.notifyOnStackEvents(product, topic2, {
273
-
description: 'description for this topic2', // description is an optional field.
274
+
description: 'description for topic2', // description is an optional field.
274
275
});
275
276
```
276
277
277
-
### CloudFormation parameters constraint
278
+
### CloudFormation template parameters constraint
278
279
279
-
CloudFormation parameters constraints allow you to configure the that are available to end users when they launch a product via defined rules.
280
-
A rule consists of one or more assertions that narrow the allowable values for parameters in a product.
281
-
You can configure multiple parameter constraints to govern the different parameters and parameter options in your products.
282
-
For example, a rule might define the various instance types that users can choose from when launching a stack that includes EC2 instances.
283
-
A parameter rule has an optional `condition` field that allows ability to configure when rules are applied.
284
-
If a `condition` is specified, all the assertions will be applied if the condition evalutates to true.
280
+
CloudFormation template parameter constraints allow you to configure the provisioning parameters that are available to end users when they launch a product.
281
+
Template constraint rules consist of one or more assertions that define the default and/or allowable values for a product’s provisioning parameters.
282
+
You can configure multiple parameter constraints to govern the different provisioning parameters within your products.
283
+
For example, a rule might define the `EC2` instance types that users can choose from when launching a product that includes one or more `EC2` instances.
284
+
Parameter rules have an optional `condition` field that allow for rule application to consider conditional evaluations.
285
+
If a `condition` is specified, all assertions will be applied if the condition evaluates to true.
285
286
For information on rule-specific intrinsic functions to define rule conditions and assertions,
286
287
see [AWS Rule Functions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-rules.html).
Allows you to configure a specific AWS `IAM` role that a user must assume when launching a product.
306
-
By setting this launch role, you can control what policies and privileges end users can have.
307
-
The launch role must be assumed by the service catalog principal.
308
-
You can only have one launch role set for a portfolio-product association, and you cannot set a launch role if a StackSets deployment has been configured.
306
+
Allows you to configure a specific `IAM` role that Service Catalog assumes on behalf of the end user when launching a product.
307
+
By setting a launch role constraint, you can maintain least permissions for an end user when launching a product.
308
+
For example, a launch role can grant permissions for specific resource creation like an `S3` bucket that the user.
309
+
The launch role must be assumed by the Service Catalog principal.
310
+
You can only have one launch role set for a portfolio-product association,
311
+
and you cannot set a launch role on a product that already has a StackSets deployment configured.
You can specify multiple accounts and regions for the product launch following StackSets conventions.
356
-
There is an additional field `allowStackSetInstanceOperations` that configures ability for end users to create, edit, or delete the stacks.
358
+
You can specify one or more accounts and regions into which stack instances will launch when the product is provisioned.
359
+
There is an additional field `allowStackSetInstanceOperations` that sets ability for end users to create, edit, or delete the stacks created by the StackSet.
357
360
By default, this field is set to `false`.
358
-
End users can manage those accounts and determine where products deploy and the order of deployment.
361
+
When launching a StackSets product, end users can select from the list of accounts and regions configured in the constraint to determine where the Stack Instances will deploy and the order of deployment.
359
362
You can only define one StackSets deployment configuration per portfolio-product association,
360
363
and you cannot both set a launch role and StackSets deployment configuration for an assocation.
0 commit comments