ServiceCatalog / Client / associate_principal_with_portfolio
associate_principal_with_portfolio#
- ServiceCatalog.Client.associate_principal_with_portfolio(**kwargs)#
Associates the specified principal ARN with the specified portfolio.
If you share the portfolio with principal name sharing enabled, the
PrincipalARN
association is included in the share.The
PortfolioID
,PrincipalARN
, andPrincipalType
parameters are required.You can associate a maximum of 10 Principals with a portfolio using
PrincipalType
asIAM_PATTERN
Note
When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is not an Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through Service Catalog, they may be able to guess the user. If this potential escalation path is a concern, then Service Catalog recommends using
PrincipalType
asIAM
. With this configuration, thePrincipalARN
must already exist in the recipient account before it can be associated.See also: AWS API Documentation
Request Syntax
response = client.associate_principal_with_portfolio( AcceptLanguage='string', PortfolioId='string', PrincipalARN='string', PrincipalType='IAM'|'IAM_PATTERN' )
- Parameters:
AcceptLanguage (string) –
The language code.
jp
- Japanesezh
- Chinese
PortfolioId (string) –
[REQUIRED]
The portfolio identifier.
PrincipalARN (string) –
[REQUIRED]
The ARN of the principal (user, role, or group). This field allows an ARN with no
accountID
ifPrincipalType
isIAM_PATTERN
.You can associate multiple
IAM
patterns even if the account has no principal with that name. This is useful in Principal Name Sharing if you want to share a principal without creating it in the account that owns the portfolio.PrincipalType (string) –
[REQUIRED]
The principal type. The supported value is
IAM
if you use a fully defined ARN, orIAM_PATTERN
if you use an ARN with noaccountID
.
- Return type:
dict
- Returns:
Response Syntax
{}
Response Structure
(dict) –
Exceptions
ServiceCatalog.Client.exceptions.InvalidParametersException
ServiceCatalog.Client.exceptions.ResourceNotFoundException
ServiceCatalog.Client.exceptions.LimitExceededException