Service Catalog: Grant access to Wildcard

[Rukenshia]

Hi,

we want to crate a Service Catalog Portfolio and use a wildcard in the role ARN. It seems like right now grantAccessToRole only accepts an IRole, so I'm not sure how to add a wildcard. Did anyone else achieve this yet?

We followed this documentation page: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_servicecatalog-readme.html#granting-access-to-a-portfolio

[peterwoodworth]

It doesn't appear to me that we directly support this. The CloudFormation documentation seems to indicate that this isn't possible, given that the only accepted value for PrincipalType is IAM. However in the API documentation, it shows that using a wildcard is valid for the PrincipalArn if IAM_PATTERN is specified for PrincipalType.

Our L2 library seems to be designed around the CloudFormation documentation being accurate for CloudFormation, but I suspect that the CloudFormation documentation is inaccurate. Would need to test this. All that we do under the hood when running grantAccessToXxx is creating a CfnPortfolioPrincipalAssociation resource like so:

      new CfnPortfolioPrincipalAssociation(this, `PortolioPrincipalAssociation${hashId}`, {
        portfolioId: this.portfolioId,
        principalArn: principalArn,
        principalType: 'IAM',
      });

Instead of using these methods we provide, we could instead try creating one of these CfnPortfolioPrincipalAssociations directly and try to use the IAM_PATTERN PrincipalType. I can try this tomorrow if you haven't tried it by then 🙂

If it turns out that we can in fact use IAM_PATTERN this way in CloudFormation, then we can take this discussion on as a feature request.

[Rukenshia]

Thanks for your quick reply and suggestion!

Sadly it looks like there is no CloudFormation support yet:

Property validation failure: [Value for property {/PrincipalType} does not match pattern {IAM}

We encountered the same issue with setting up the CodeStar integration for Service Catalog Products. We've now added a script that we run after cdk deploy that uses the CDK outputs to then call the API to set up the principal association and the product codestar integration.

Thanks for your help again :)

[peterwoodworth]

Unfortunate, if you'd like this in CloudFormation officially you should see if there's an issue on the CloudFormation Coverage Roadmap and submit an issue if one doesn't already exist.

Running a script after cdk deploy sounds like a fine solution! You could also make use of AwsCustomResource, or write your own custom resource to make the API call during CDK deployment

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.

[avoidik]

xref. #29770