AssociatePrincipalWithPortfolio - AWS Service Catalog


Associates the specified principal ARN with the specified portfolio.

If you share the portfolio with principal name sharing enabled, the PrincipalARN association is included in the share.

The PortfolioID, PrincipalARN, and PrincipalType parameters are required.

You can associate a maximum of 10 Principals with a portfolio using PrincipalType as IAM_PATTERN


When you associate a principal with portfolio, a potential privilege escalation path may occur when that portfolio is then shared with other accounts. For a user in a recipient account who is not an AWS Service Catalog Admin, but still has the ability to create Principals (Users/Groups/Roles), that user could create a role that matches a principal name association for the portfolio. Although this user may not know which principal names are associated through AWS Service Catalog, they may be able to guess the user. If this potential escalation path is a concern, then AWS Service Catalog recommends using PrincipalType as IAM. With this configuration, the PrincipalARN must already exist in the recipient account before it can be associated.

Request Syntax

{ "AcceptLanguage": "string", "PortfolioId": "string", "PrincipalARN": "string", "PrincipalType": "string" }

Request Parameters

The request accepts the following data in JSON format.


The language code.

  • en - English (default)

  • jp - Japanese

  • zh - Chinese

Type: String

Length Constraints: Maximum length of 100.

Required: No


The portfolio identifier.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 100.

Pattern: ^[a-zA-Z0-9_\-]*

Required: Yes


The ARN of the principal (IAM user, role, or group). This field allows an ARN with no accountID if PrincipalType is IAM_PATTERN.

You can associate multiple IAM patterns even if the account has no principal with that name. This is useful in Principal Name Sharing if you want to share a principal without creating it in the account that owns the portfolio.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1000.

Required: Yes


The principal type. The supported value is IAM if you use a fully defined ARN, or IAM_PATTERN if you use an ARN with no accountID.

Type: String

Valid Values: IAM | IAM_PATTERN

Required: Yes

Response Elements

If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.



One or more parameters provided to the operation are not valid.

HTTP Status Code: 400


The current limits of the service would have been exceeded by this operation. Decrease your resource use or increase your service limits and retry the operation.

HTTP Status Code: 400


The specified resource was not found.

HTTP Status Code: 400

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: