AWS services or capabilities described in AWS Documentation may vary by region/location. Click Getting Started with Amazon AWS to see specific differences applicable to the China (Beijing) Region.
Container for the parameters to the AssociatePrincipalWithPortfolio operation. Associates the specified principal ARN with the specified portfolio.
If you share the portfolio with principal name sharing enabled, the PrincipalARN
association is included in the share.
The PortfolioID
, PrincipalARN
, and PrincipalType
parameters are
required.
You can associate a maximum of 10 Principals with a portfolio using PrincipalType
as IAM_PATTERN
.
When you associate a principal with portfolio, a potential privilege escalation path
may occur when that portfolio is then shared with other accounts. For a user in a
recipient account who is not an Service Catalog Admin, but still has the ability
to create Principals (Users/Groups/Roles), that user could create a role that matches
a principal name association for the portfolio. Although this user may not know which
principal names are associated through Service Catalog, they may be able to guess
the user. If this potential escalation path is a concern, then Service Catalog recommends
using PrincipalType
as IAM
. With this configuration, the PrincipalARN
must already exist in the recipient account before it can be associated.
Namespace: Amazon.ServiceCatalog.Model
Assembly: AWSSDK.ServiceCatalog.dll
Version: 3.x.y.z
public class AssociatePrincipalWithPortfolioRequest : AmazonServiceCatalogRequest IAmazonWebServiceRequest
The AssociatePrincipalWithPortfolioRequest type exposes the following members
Name | Description | |
---|---|---|
AssociatePrincipalWithPortfolioRequest() |
Name | Type | Description | |
---|---|---|---|
AcceptLanguage | System.String |
Gets and sets the property AcceptLanguage. The language code.
|
|
PortfolioId | System.String |
Gets and sets the property PortfolioId. The portfolio identifier. |
|
PrincipalARN | System.String |
Gets and sets the property PrincipalARN.
The ARN of the principal (user, role, or group). If the arn:partition:iam:::resource-type/resource-id The ARN resource-id can be either:
Examples of an acceptable wildcard ARN:
Examples of an unacceptable wildcard ARN:
You can associate multiple The "?" wildcard character matches zero or one of any character. This is similar to ".?" in regular regex context. The "*" wildcard character matches any number of any characters. This is similar to ".*" in regular regex context. In the IAM Principal ARN format (arn:partition:iam:::resource-type/resource-path/resource-name), valid resource-type values include user/, group/, or role/. The "?" and "*" characters are allowed only after the resource-type in the resource-id segment. You can use special characters anywhere within the resource-id. The "*" character also matches the "/" character, allowing paths to be formed within the resource-id. For example, arn:aws:iam:::role/*/ResourceName_? matches both arn:aws:iam:::role/pathA/pathB/ResourceName_1 and arn:aws:iam:::role/pathA/ResourceName_1. |
|
PrincipalType | Amazon.ServiceCatalog.PrincipalType |
Gets and sets the property PrincipalType.
The principal type. The supported value is |
.NET Core App:
Supported in: 3.1
.NET Standard:
Supported in: 2.0
.NET Framework:
Supported in: 4.5, 4.0, 3.5