AWS CLI Command Reference

Note:

You are viewing the documentation for an older major version of the AWS CLI (version 1).

AWS CLI version 2, the latest major version of AWS CLI, is now stable and recommended for general use. To view this page for the AWS CLI version 2, click here. For more information see the AWS CLI version 2 installation instructions and migration guide.

[ aws . servicecatalog ]

associate-principal-with-portfolio

Description

Associates the specified principal ARN with the specified portfolio.

If you share the portfolio with principal name sharing enabled, the PrincipalARN association is included in the share.

The PortfolioID , PrincipalARN , and PrincipalType parameters are required.

You can associate a maximum of 10 Principals with a portfolio using PrincipalType as IAM_PATTERN .

Note

When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is not an Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through Service Catalog, they may be able to guess the user. If this potential escalation path is a concern, then Service Catalog recommends using PrincipalType as IAM . With this configuration, the PrincipalARN must already exist in the recipient account before it can be associated.

See also: AWS API Documentation

Synopsis

  associate-principal-with-portfolio
[--accept-language <value>]
--portfolio-id <value>
--principal-arn <value>
--principal-type <value>
[--cli-input-json <value>]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]

Options

--accept-language (string)

The language code.

  • jp - Japanese
  • zh - Chinese

--portfolio-id (string)

The portfolio identifier.

--principal-arn (string)

The ARN of the principal (user, role, or group). If the PrincipalType is IAM , the supported value is a fully defined IAM Amazon Resource Name (ARN) . If the PrincipalType is IAM_PATTERN , the supported value is an IAM ARN without an AccountID in the following format:

arn:partition:iam:::resource-type/resource-id

The ARN resource-id can be either:

  • A fully formed resource-id. For example, arn:aws:iam:::role/resource-name or arn:aws:iam:::role/resource-path/resource-name
  • A wildcard ARN. The wildcard ARN accepts IAM_PATTERN values with a "*" or "?" in the resource-id segment of the ARN. For example arn:partition:service:::resource-type/resource-path/resource-name . The new symbols are exclusive to the resource-path and resource-name and cannot replace the resource-type or other ARN values. The ARN path and principal name allow unlimited wildcard characters.

Examples of an acceptable wildcard ARN:

  • arn:aws:iam:::role/ResourceName_*
  • arn:aws:iam:::role/*/ResourceName_?

Examples of an unacceptable wildcard ARN:

  • arn:aws:iam:::*/ResourceName

You can associate multiple IAM_PATTERN s even if the account has no principal with that name.

The "?" wildcard character matches zero or one of any character. This is similar to ".?" in regular regex context. The "*" wildcard character matches any number of any characters. This is similar to ".*" in regular regex context.

In the IAM Principal ARN format (arn:partition:iam:::resource-type/resource-path/resource-name ), valid resource-type values include user/ , group/ , or role/ . The "?" and "*" characters are allowed only after the resource-type in the resource-id segment. You can use special characters anywhere within the resource-id.

The "*" character also matches the "/" character, allowing paths to be formed within the resource-id. For example, arn:aws:iam:::role/**** /ResourceName_?* matches both arn:aws:iam:::role/pathA/pathB/ResourceName_1 and arn:aws:iam:::role/pathA/ResourceName_1 .

--principal-type (string)

The principal type. The supported value is IAM if you use a fully defined Amazon Resource Name (ARN), or IAM_PATTERN if you use an ARN with no accountID , with or without wildcard characters.

Possible values:

  • IAM
  • IAM_PATTERN

--cli-input-json (string) Performs service operation based on the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, the CLI values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command's default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

  • json
  • text
  • table

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

  • on
  • off
  • auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

Examples

Note

To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.

Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal's quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .

To associate a principal with a portfolio

The following associate-principal-with-portfolio example associates a user with the specified portfolio.

aws servicecatalog associate-principal-with-portfolio \
    --portfolio-id port-2s6abcdefwdh4 \
    --principal-arn arn:aws:iam::123456789012:user/usertest \
    --principal-type IAM

This command produces no output.

Output

None